80286 



High-Performance Microprocessor with 
Memory Management and Protection 



DISTINCTIVE CHARACTERISTICS 



High performance processor (up to six times iAPX 86 
when using the 8 MHz 80286) 
Large address space 

- 16 megabytes physical 

- 1 gigabyte virtual memory per tasl< 

Integrated memory management, four-level memory 
protection and support for virtual memory and operating 
systems 



Two iAPX 86 upward compatible operating modes 

- IAPX 86 real address mode 

- Protected virtual address mode 

High bandwidth bus interface (8 megabyte/sec) 
Range of clocl< rates 

- 10 tk^Hz for 80286-10 

- 8 MHz 80286-8 

- 6 MHz 80286-6 



GENERAL DESCRIPTION 



The 80286 is an advanced, high performance microproces- 
sor with specially optimized capabilities for multiple user 
and multi-tasking systems. The 80286 has built-in memory 
protection that supports operating system and task isola- 
tion as well as program and data privacy within tasks. An 8 
MHz 80286 provides up to six times greater throughput 
than the standard 5 MHz 8086. The 80286 includes 
memory management capabilities that map up to 2^° bytes 
(one gigabyte) of virtual address space per task into 2^'' 
bytes (16 megabytes) of physical memory. 

The 80286 is upward compatible with IAPX 86 and 88 
software. Using iAPX 86 real address mode, the 80286 is 
object code compatible with existing IAPX 86, 88 software. 



In protected virtual address mode, the 80286 is source 
code compatible with iAPX 86, 88 software and may require 
upgrading to use virtual addresses supported by the 
80286' s integrated memory management and protection 
mechanism. Both modes operate at full 80286 performance 
and execute a superset of the iAPX 86 and 88 instructions. 

The 80286 provides special operations to support the 
efficient implementation and execution of operating sys- 
tems. For example, one instruction can end execution of 
one task, save its state, switch to a new task, load its state, 
and start execution of the new task. The 80286 also 
supports virtual memory systems by providing a segment- 
not-present exception and restartable instructions. 
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CONNECTION DIAGRAMS 
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Component Pad Views - 

as viewed from underside of component on the P.C. 

board. 



P.C. Board Views - 

as viewed from the component side of the P.C. board. 
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ORDERING INFORMATION 

Commodity Products 

AMD products are available in several packages and operating ranges. The order number (Valid Combination) is formed 
by a combination of: A. Temperature Range 

B. Package Type 

C. Device Number 

D. Speed Option (If applicable) 

E. Optional Processing 



60286 



-10 



B 



- E. OPTIONAL PROCESSING 

Blank = Standard 

Processing 
B = Burn-in 



Valid Combinations 


R, A, 


80286 


-10, -10B 


-8, -8B 


-6, -6B 



— D. SPEED OPTION 

-10 = 10 MHz 
-8 = 8 MHz 
-6 = 6 MHz 

-C. DEVICE NUMBER/DESCRIPTION 

80286 

High Performance Microprocessor 



— B. PACKAGE TYPE 

R = 68-Pin Ceramic Leadless Chip Carrier 
A = 68-Pin Pin Grid Array 

-A. TEMPERATURE RANGE 

Blank = Commercial (0 to + 55''C) 



Valid Combinations 

Consult ttie local AMD sales office to confirm 
availability of specific valid combinations, to 
ctieck on newly released valid combinations, 
and to obtain additional data on AMD's standard 
military grade products. 



PIN DESCRIPTION 



Active 
State 



Active 
HIGH 



Name 



I/O 



Description 



System Clock provides the fundamental timing (or 80286 systems. It is a 16 MHz signal divided by two 
inside ttie 80286 to generate the 8 MHz processor clock. The internal divide-by-two circuitry can be 
synchronized to an external clock generator by a LOW-to-HIGH transition on the RESET input. 



Active 
HIGH 



Do-Dl5 



I/O 



Data Bus inputs data during memory, I/O, and interrupt acknowledge read cycles; outputs data during 
memory and I/O write cycles. The data bus is active HIGH and floats to tiiree-state OFF during bus hold 
acknowledge. 



Active 
HIGH 



A23-A0 



Address Bus outputs physical memory and I/O port addresses. Aq is LOW when data is to be transferred 
on pins D7_o. A23-A16 are LOW during I/O transfers. The address bus is active HIGH and floats to 
three-state OFF during bus hold acknowledge. 



Active 
LOW 



Bus High Enable indicates transfer of data on the upper byte of the dat a bu s Di5_8. Eight-bit oriented 
devices a ssigne d to the upper byte of the data bus would normally use BHE to condition chip select 
functions. BHE is active LOW and floats to three-state OFF during bus hold acknowledge. 



Active 
LOW 



BHE and Ao Encodings 


BHE Value 


Ao Value 


Function 








Word Transfer 





1 


Byte transfer on upper half of data bus (Di5_e) 


1 





Byte transfer on lower half of data bus (Dy.o) 


1 


1 


Reserved 



Bus Cycle Status indicates initiation of a bus cycle and, along with M/IO_and COD/INTA, defines the type 
of bus cycle. The bus is in a Ts state whenever one or both are LOW. S1 and SO are active LOW and 
float to three-state OFF during bus hold acknowledge. 



80286 Bus Cycle Status Definition 



COD/INTA 



(LOW) 



1 (HIGH) 



1 



M/IO 



SI 



SO 



Bus cycle initiated 



Interrupt acknowledge 



Reserved 



Reserved 



None: not a status cycle 



IF Ai = 1 then halt; else shutdown 



f^emory data read 



Memory data write 



None; not a status cycle 



Reserved 



I/O read 



I/O write 



None; not a status cycle 



Reserved 



Memory instruction read 



Reserved 



None; not a status cycle 



Memory/IO Select distinguishes memory access from I/O access. If HIGH during Ts, a memory cycle or a 
halt/_shuldown cycle is in progress. If LOW, an I/O cycle or an interrupt acknowledge cycle is in progress. 
M/IO floats to three-state OFF during bus hold acknowledge. 



Code/Interrupt Acknowledge distinguishes instruction fetch cycles from memory data read cycles. Also 
distinguishes interrupt acknowledge cycles from I/O cycles. COD/INTA floats to three-state OFF during bus 

hold acknowledge. 



Active 
LOW 



Bus Lock indicates that other system bus masters are not to gain control of the system bus following the 
current bus cycle. The LOCK signal may be activated explicitly by the "LOCK" instruction prefix or 
automatically by 802 86 hardware during memory XCHG instructions, interrupt acknowledge, or descriptor 
table access. LOCK is active LOW and floats to three-state OFF during bus hold acknowledge. 



Active 

LOW 



READY 



Bus Re ady terminates a bus cycle. Bus cycles are extended without limit until terminated by READY LOW. 
READY is an active LOW synchro nous input requiring set-up and hold times relative to the system clock be 
met for correct operation. READY is ignored during bus hold acknowledge. 



Active 
HIGH 



HOLD, 
HLDA 



Bus Hold Request and Hold Acknowledge control ownership of the 80286 local bus. The HOLD input allows 
another local bus master to request control of the local bus. When control is granted, the 80286 will float 
its bus drivers to three-state OFF and then active HLDA, thus entering the bus hold acknowledge condition. 
The local bus will remain granted to the requesting master until HOLD becomes inactive which results in the 
80286 deactivating HLDA and regaining control of the local bus. This terminates the bus hold acknowledge 
condition. HOLD may be asynchronous to the system clock. These signals are active HIGH. 



PIN DESCRIPTION (Cont.) 



Active 
State 



Name 



I/O 



Description 



Active 
HIGH 



Interrupt Request requests the 80286 to suspend its current program execution and service a pending 
external request. Interrupt requests are masked whenever the Interrupt enable bit in the flag word is cleared. 
When the 80286 responds to an interrupt request, it performs two interrupt acknowledge bus cycles to read 
an 8-bit interrupt vector that identifies the source of the interrupt. To assure program interruption, INTR must 
remain active until the first interrupt acknowledge cycle is completed. INTR is sampled at the beginning of 
each processor cycle and must be active HIGH at least two processor cycles before the current Instruction 
ends in order to interrupt before the next instruction. INTR is level sensitive, active HIGH, and may be 
asynchronous to the system clock. 



Active 
HIGH 



Non-maskable Interrupt Request interrupts the 80286 with an internally supplied vector value of 2. No 
interrupt acknowledge cycles are performed. The interrupt enable bit in the 80286 flag word does not affect 
this input. The NMI input is active HIGH, may be asynchronous to the system clock, and is edge triggered 
after internal synchronization. For proper recognition, the input must have been previously LOW for at least 
four system clock cycles and remain HIGH for at least four system clock cycles. 



Processor Extension Operand Request and Acknowledge extended the memory management and protection 
capabilities of the 80286 to processor extension s. The P EREQ input requests the 80286 to perform a data 
operand transfer for a processor extension. The PEACK output signals the processor extension when the 
reques ted ope rand is being transferred. PEREQ is active HIGH and may be asynchronous to the system 
clock. PEACK is active LOW. 



Active 
LOW 



BUSY, 



Processor Exten sion Busy and Error indicate the operating condition of a processor extension to the 60 286. 
An active BUSY input stops 80286 program execution on WAIT and some ESC instructions until BUSY 
becom es inact ive (HIGH). The 80286 may be interrupted while waiting for BUSY to become inactive. An 
active ERROR input causes the 80286 to perform a processor extension interrupt when executing WAIT or 
some ESC instructions. These Inputs are active LOW and may be asynchronous to the system clock. 



Active 
HIGH 



System Reset clears the internal logic of the 80286 and is active HIGH. The 80266 may be reinitialized at 
any time with a LOW-to-HIGH transition on RESET which remains active for more than 16 system clock 
cycles. During RESET active, the output pins of the 80286 enter the state shown below; 



80286 Pin State During Reset 


Pin Vaiue 


Pin Names 


1 (HIGH) 


SO, SI, PEACK, A23-A0, BHE, LOCK 


(LOW) 


M/IO, COD/INTA, HLDA 


three-state OFF 


D15-D0 



Operation of the 80286 begins after a HIGH-to-LOW transition on RESET. The HIGH-to-LOW transition of 
RESET must be synchronous to the system clock. Approximately 50 system clock cycles are required by 
the 60286 for internal initializations before the first bus cycle to fetch code from the power-on execution 
address is performed. 

A LOW-to-HIGH transition of RESET synchronous to the system clock, will begin a new processor cycle at 
the next HIGH-to-LOW transition of the system clock. The LOW-to-HIGH transition of RESET may be 
asynchronous to the system clock; however, in this case it cannot be predetermined which phase of the 
processor clock will occur during the next system clock period. Synchronous LOW-to-HIGH transitions of 
RESET are only required for systems where the processor clock must be phase synchronous to another 
clock. 



Active 
HIGH 



Vss 



System Ground; VOLTS. 



Active 
HIGH 



Vcc 



System Power; +5 Volt Power Supply. 



Active 
HIGH 



Substrate Filter Capacitor; a 0.047(if ±20% 12 V capacitor must be connected between this pin and ground. 
This capacitor filters the output of the internal substrate bias generator. A maximum DC leakage current of 
1 /ia is allowed through the capacitor. 

For correct operation of the 80286, the substrate bias generator must charge this capacitor to its operating 
voltage. The capacitor charge-up time is 5 milliseconds (max.) after Voc and CLK reach their specified AC 
and DC parameters. RESET may be applied to prevent spurious activity by the CPU during this time. After 
this time, the 80286 processor clock can be phase synchronized to another clock by pulsing RESET LOW 
synchronous to the system clock. 



FUNCTIONAL DESCRIPTION 

Introduction 

Tlie 80286 Is an advanced, high-performance microprocessor 
with specially optimized capabilities for multiple user and multi- 
tasl<ing systems. Depending on the application, the 80286's 
performance is up to six times faster than the standard 5 IvlHz 
8086' s, while providing complete upward software compatibili- 
ty with AMD's iAPX 86, 88, and 186 family of CPU's. 

The 80286 operates in two modes: iAPX 86 real address mode 
and protected virtual address mode. Both modes execute a 
superset of the iAPX 86 and 88 instruction set. 



In iAPX 86 real address mode programs use real addresses 
with up to one megabyte of address space. Programs use 
virtual addresses in protected virtual address mode, also 
called protected mode. In protected mode, the 80286 CPU 
automatically maps 1 gigabyte of virtual addresses per tasl< 
into a 16 megabyte real address space. This mode also 
provides memory protection to Isolate the operating system 
and ensure privacy of each tasl<'s programs and data. Both 
modes provide the same base instruction set, registers, and 
addressing modes. 

The following pages describe first, the base 80286 architec- 
ture common to both modes; second, iAPX 86 real address 
mode; and third, protected mode. 



80286 Base Architecture 

The iAPX 86, 88, 186, and 286 CPU family all contain the 
same basic set of registers, instructions, and addressing 
modes. The 80286 processor is upward compatible with the 
8086, 8088, and 80186 CPU's. 

Register Set 

The 80286 base architecture has fifteen registers as shown in 
Figure 1. These registers are grouped into the following four 
categories: 

General Registers: Eight 16-bit general purpose registers 
used to contain arithmetic and logical operands. Four of these 
(AX, BX, CX, and DX) can be used either in their entirety as 1 6- 
bit words or split into pairs of separate 8-bit registers. 



Segment Registers: Four 16-bit special purpose registers 
select, at any given time, the segments of memory that are 
immediately addressable for code, stack, and data. (For 
usage, refer to Memory Organization.) 

Base and Index Registers: Four of the general purpose 
registers may also be used to determine offset addresses of 
operands in memory. These registers may contain base 
addresses or indexes to particular locations within a segment. 
The addressing mode determines the specific registers used 
for operand address calculations. 

Status and Control Registers: Three 16-bit special purpose 
registers record or control certain aspects of the 80286 
processor state. These include the Instruction Pointer, which 
contains the offset address of the next sequential instruction 
to be executed. 



16-BIT 

REGISTER 

NAME 



BYTE 

ADDRESSABLE 

(S-BIT 

REGISTER 

NAMES 

SHOWN) 



AX 


AH 


AL 


DX 


DH 


DL 


CX 


CH 


CL 


BX 


BH 


BL 


6P 




SI 




Dl 




SP 





SPECIAL 
REGISTER 
FUNCTIONS 



MULTIPLY'DIVIDE 
I'O INSTRUCTIONS 



LOOP'SHIFT'REPEAT COUNT 



BASE REGISTERS 



INDEX REGISTERS 
STACK POINTER 



cs 




DS 




ss 




ES 






SEGMENT REGISTERS 

5 


F 




IP 




MSW 





CODE SEGMENT SELECTOR 
DATA SEGMENT SELECTOR 
STACK SEGMENT SELECTOR 
EXTRA SEGMENT SELECTOR 



FLAGS 

INSTRUCTION POINTER 

MACHINE STATUS WORD 



GENERAL 
REGISTERS 



STATUS AND CONTROL 
REGISTERS 



Figure 1. Register Set 



STATUS FLAGS: 
CARRY 
PARITY 
AUXILIARY CARRY 
ZERO ' 
SIGN ' 
OVERFLOW ■ 



15 



:Em: 



14 



13 



EI 



13 



MI 



K\\\M - ^\\\\l 



CONTROL FLAGS: 
TRAP FLAG 
INTERRUPT ENABLE 
DIRECTION FLAG 



SPECIAL FIELDS: 
I/O PRIVILEGE LEVEL 
NESTED TASK FLAG 



K\\\mm\K\\\mm\K\\\mm\K\\\\K\m\w- 



TS EM MP PE 



ESI' 



TASK SWITCH ■ 

PROCESSOR EXTENSION EMULATED ' 

MONITOR PHOCESSOR EXTENSION . 

PROTECTION ENABLE • 



DF003640 



Figure 2. Status and Control Register Bit Functions 



Flags Word Description 

The Flags word (Flags) records specific characteristics of the 
result of logical and arithmetic instructions (bits 0, 2, 4, 6, 7, 
and 11) and controls the operation of the 80286 within a given 
operating mode (bits 8 and 9). Flags is a 16-bit register. The 
function of the flag bits is given in Table 1. 

Table 1. Flags Word Bit Functions 



Bit 
Position 


Name 


Function 





CF 


Carry Flag — Set on high-order bit carry or 
borrow; cleared otherwise 


2 


PF 


Parity Flag — Set if low-order 8 bits of 
result contain an even number of 1 bits; 
cleared othenA'ise 


4 


AF 


Set on carry-from or borrow-to the low- 
order four bits of AL; cleared otherwise 


6 


ZF 


Zero Flag — Set if result is zero; cleared 
othenwise 


7 


SF 


Sign Flag — Set equal to high-order bit of 
result (0 if positive, 1 if negative) 


11 


OF 


Overflow Flag — Set if result is a too-large 
large positive number or a too-small 
negative number (excluding sign-bit) to fit 
in destination operand; cleared otherwise 


8 


TF 


Single Step Flag — Once set, a single 
step interrupt occurs after the next 
instruction executes. TF is cleared by the 
single step interrupt. 


9 


IF 


Interrupt-Enable Flag — When set, 
maskable interrupts will cause the CPU to 
transfer control to an interrupt vector 
specified location 


10 


DF 


Direction Flag — Causes string 
instructions to auto decrement the 
appropriate index registers when set. 
Clearing DF causes auto increment. 



GENERAL PURPOSE 


MOV 


Move byte or word 


PUSH 


Push word onto stack 


POP 


Pop word off stack 


PUSHA 


Push all registers on stack 


POPA 


Pop all registers from stack 


XCHG 


Exchange byte or word 


XLAT 


Translate byte 


INPUT/OUTPUT 1 


IN 


Input byte or word 


OUT 


Output byte or word 


ADDRESS OBJECT | 


LEA 


Load effective address 


LDS 


Load pointer using DS 


LES 


Load pointer using ES 


FU^G TRANSFER | 


LAHF 


Load AH register from flags 


SAHF 


Store AH register in flags 


PUSHF 


Push flags onto stack 


POPF 


Pop flags off stack 



ADDITION 


ADD 


Add byte or word 


ADC 


Add byte or word with carry 


INC 


Increment byte or word by 1 


AAA 


ASCII adjust for addition 


DAA 


Decimal adjust for addition 


SUBTRACTION | 


SUB 


Subtract byte or word 


SBB 


Subtract byte or word with borrow 


DEC 


Decrement byte or word by 1 


NEG 


Negate byte or word 


CMP 


Compare byte or word 


AAS 


ASCII adjust for subtraction 


DAS 


Decimal adjust for subtraction 


fUlULTIPLICATION | 


MUL 


Multiply byte or word unsigned 


IMUL 


Integer multiply byte or word 


AAM 


ASCII adjust for multiply 


DIVISION 1 


DIV 


Divide byte or word unsigned 


IDIV 


Integer divide byte or word 


AAD 


ASCII adjust for division 


CBW 


Convert byte to word 


CWD 


Convert word to doubleword 



Figure 4. Arithmetic Instructions 



MOVS 


Move byte or word string 


INS 


Input bytes or word string 


OUTS 


Output bytes or word string 


CMPS 


Compare byte or word string 


SCAS 


Scan byte or word string 


LODS 


Load byte or word string 


STOS 


Store byte or word string 


REP 


Repeat 


REPE/REPZ 


Repeat while equal/zero 


REPNE/REPNZ 


Repeat while not equal/not zero 



Figure 5. String Instructions 



Figure 3. Data Transfer Instructions 



LOGICALS 1 


NOT 


"Not" byte or word 


AND 


"And" byte or word 


OR 


"Inclusive or" byte or word 


XOR 


"Exclusive or" byte or word 


TEST 


"Test" byte or word 


SHIFTS ] 


SHL/SAL 


Shift logical/arithmetic left byte or word 


SHR 


Shift logical right byte or word 


SAR 


Shift arithmetic right byte or word 


ROTATES 


ROL 


Rotate left byte or word 


ROR 


Rotate right byte or word 


RCL 


Rotate through carry left byte or word 


RCR 


Rotate through carry right byte or word 



Figure 6. Stiift/Rotate/Logical Instructions 



CONDITIONAL TRANSFERS 



UNCONDITIONAL TRANSFERS 



JA/JNBE 



Jump if above/not below nor equal 



CALL 



Call procedure 



JAE/JNB 



Jump if above or equal/not below 



RET 



Return from procedure 



JB/JNAE 



JBE/JNA 



Jump if below/not above nor equal 



JMP 



Jump 



Jump if below or equal/not above 



JC 



Jump if carry 



ITERATION CONTROLS 



JE/JZ 



Jump if equal/zero 



JG/JNLE 



Jump if greater/not less nor equal 



LOOP 



Loop 



JGE/JNL 



Jump if greater or equal/not less 



LOOPE/LOOPZ 



Loop if equal/zero 



JL/JNGE 



Jump if less/not greater nor equal 



LOOPNE/LOOPNZ 



Loop if not equal/not zero 



JLE/JNG 



JNC 



Jump if less or equal/not greater 



JCXZ 



Jump if register CX = 



Jump if not carry 



JNE/JNZ 



Jump if not equal/not zero 



INTERRUPTS 



JNO 



JNP/JPO 



Jump if not overflow 



Jump if not parity/parity odd 



INT 



Interrupt 



JNS 



Jump if not sign 



INTO 



Interrupt if overflow 



JO 



JP/JPE 



JS 



Jump if overflow 



IRET 



Interrupt return 



Jump if parity/parity even 



Jump if sign 



Figure 7. Program Transfer Instructions 



FLAG OPERATIONS 


STC 


Set carry flag 


CLC 


Clear carry flag 


CMC 


Complement carry flag 


STD 


Set direction flag 


CLD 


Clear direction flag 


STI 


Set interrupt enable flag 


CLI 


Clear interrupt enable flag 


EXTERNAL SYNCHRONIZATION 


HLT 


Halt until interrupt or reset 


WAIT 


Wait for BUSY not active 


ESC 


Escape to extension processor 


LOCK 


Lock bus during next instruction 


NO OPERATION | 


NOP 


No operation | 


EXECUTION ENVIRONMENT CONTROL | 


LMSW 


Load machine status word 


SMSW 


Store machine status word 



Figure 8. Processor Control Instructions 



ENTER 


Format stack for procedure entry 


LEAVE 


Restore stack for procedure exit 


BOUND 


Detects values outside prescribed range 



iVlemory Organization 

Memory is organized as sets of variable length segments. 
Each segment is a linear contiguous sequence of up to 
64K(2^^) 8-bit bytes. Memory is addressed using a two- 
component address (a pointer) that consists of a 16-bit 
segment selector and a 16-bit offset. The segment selector 
indicates the desired segment in memory. The offset compo- 
nent indicates the desired byte address within the segment. 
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Figure 10. Two-Component Address 



Figure 9. High-Level Instructions 



Table 2. Segment Register Selection Rules 



Memory 
Reference Needed 



Segment Register 
Used 



Implicit Segment 
Selection Ruie 



Instructions 



Code (CS) 



Automatic with instruction prefetch 



Staci< 



Stack (SS) 



All stack pushes and pops. Any memory reference which uses BP as a base 
register. 



Local Data 



Data (DS) 



All data references except when relative to stack or string destination 



External (Global) Data 



Extra (ES) 



Alternate data segment and destination of string operation 



All instructions that address operands in memory must specify 
the segment and the offset. For speed and compact instruc- 
tion encoding, segment selectors are usually stored in the high 
speed segment registers. An instruction need specify only the 
desired segment register and an offset to address a memory 
operand. 

Most instructions need not explicitly specify which segment 
register is used. The correct segment register is automatically 
chosen according to the rules of Table 2. These rules follow 
the way programs are written (see Figure 11) as independent 
modules that require areas for code and data, a stack, and 
access to external data areas. 

Special segment override instruction prefixes allow the implicit 
segment register selection rules to be overridden for special 
cases. The stack, data, and extra segments may coincide for 
simple programs. To access operands that do not reside in 
one of the four immediately available segments, either a full 
32-bit pointer can be used or a new segment selector must be 
loaded. 

Addressing Modes 

The 80286 provides a total of eight addressing modes for 
instructions to specify operands. Two addressing modes are 
provided for instructions that operate on register or immediate 
operands: 

Register Operand Mode: The operand is located in one of 
the 8- or 16-bit general registers. 

Immediate Operand Mode: The operand is included in the 
instruction. 

Six modes are provided to specify the location of an operand 
in a memory segment. A memory operand address consists of 
two 16-bit components: segment selector and offset. The 
segment selector is supplied by a segment register either 
implicitly chosen by the addressing mode or explicitly chosen 
by a segment override prefix. The offset is calculated by 
summing any combination of the following three address 
elements: 

the displacement (an 8- or 16-bit immediate value con- 
tained in the instruction) 

the base (contents of either the BX or BP base registers) 

the index (contents of either the SI or Dl index registers) 

Any carry out from the 16-bit addition is ignored. Eight-bit 
displacements are sign extended to 16-bit values. 

Combinations of these three address elements define the six 
memory addressing modes, here described. 

Direct Mode: The operand's offset is contained in the 
instruction as an 8- or 16-bit displacement element. 



Register Indirect Mode: The operand's offset is in one of the 
registers SI, Dl, BX, or BP. 

Based Mode: The operand's offset is the sum of an 8- or 16- 
bit displacement and the contents of a base register (BX or 
BP). 
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Figure 11. Segmented Memory Helps 
Structure Software 

Indexed Mode: The operand's offset is the sum of an 8- or 
16-bit displacement and the contents of an index register (SI 
or Dl). 

Based Indexed Mode: The operand's offset is the sum of the 
contents of a base register and an index register. 

Based Indexed Mode with Displacement: The operand's 
offset is the sum of a base register's contents, an index 
register's contents, and an 8- or 16-bit displacement. 
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Data Types 

The 80286 directly supports the following data types: 

Integer: A signed binary numeric value contained 

in an 8-bit byte or a 16-bit word. All op- 
erations assume a 2's complement repre- 
sentation. Signed 32- and 64-bit integers 
are supported using the 80287 Numeric 
Data Processor. 

Ordinal: An unsigned binary numeric value con- 

tained in an 8-bit byte or 16-bit word. 

Pointer: A 32-bit quantity, composed of a segment 

selector component and an offset compo- 
nent. Each component is a 16-bit word. 

String: A contiguous sequence of bytes or words. 

A string may contain from 1 byte to 64K 
bytes. 

ASCII: A byte representation of alphanumeric 

and control characters using the ASCII 
standard of character representation. 

BCD: A byte (unpacked) representation of the 

decimal digits 0-9. 

Packed BCD: A byte (packed) representation of two 
decimal digits 0-9 storing one digit in 
each nibble of the byte. 

Floating Point: A signed 32-, 64-, or 80-bit real number 
representation. (Floating point operands 
are supported using the lAPX 287 Numer- 
ic Processor configuration.) 
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Figure 12 graphically represents the data types supported by 
the 80286. 

I/O Space 

The I/O space consists of 64K 8-bit or 32K 16-bit ports. I/O 
instructions address the I/O space with either an 8-bit port 
address, specified in the instruction, or a 1 6-bit port address in 
the DX register. 8-bit port addresses are zero extended such 
that Ai5-A8 are LOW. I/O port addresses 00F8(H) through 
OOFF(H) are reserved. 
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Figure 12. 80286 Supported Data Types 



Table 3. Interrupt Vector Assignments 



Function 



Interrupt 
Number 



Related 
Instructions 



Return Address 
Before Instruction 
Causing Exception? 



Divide error exception 



DIV, IDIV 



Yes 



Single step interrupt 



All 



NMI interrupt 



All 



Breakpoint interrupt 



INT 



INTO detected overflow exception 



INTO 



No 



BOUND range exceeded exception 



BOUND 



Yes 



Invalid opcode exception 



Any undefined opcode 



Yes 



Processor extension not available exception 



ESC or WAIT 



Yes 



Reserved 



8-15 



Processor extension error input 



16 



ESC or WAIT 



Reserved 



17-31 



User defined 



32-255 



Interrupts 

An interrupt transfers execution to a new program location. 
The old program address (CS;IP) and mactiine state (Flags) 
are saved on the stacl^ to allow resumption of the interrupted 
program. Interrupts fall into three classes: hardware initiated, 
INT instructions, and instruction exceptions. Hardware initiated 
interrupts occur in response to an external input and are 
classified as non-masl<able or maskable. Programs may cause 
an interrupt with an INT instruction. Instruction exceptions 
occur when an unusual condition, which prevents further 
instruction processing, is detected while attempting to execute 
an instruction. The return address from an exception will 
always point at the instruction causing the exception and 
include any leading instruction prefixes. 

A table containing up to 256 pointers defines the proper 
interrupt service routine for each interrupt. Interrupts 0-31, 
some of which are used for instruction exceptions, are 
reserved. For each interrupt, an 8-bit vector must be supplied 
to the 80286 which identifies the appropriate table entry. 
Exceptions supply the interrupt vector internally. INT instruc- 
tions contain or imply the vector and allow access to all 256 
interrupts. Maskable hardware initiated interrupts supply the 8- 
bit vector to the CPU during an interrupt acknowledge bus 
sequence. Non-maskable hardware interrupts use a prede- 
fined internally supplied vector. 

Maskable Interrupt (INTR) 

The 80286 provides a maskable hardware interrupt request 
pin, INTR. Software enables this input by setting the interrupt 
flag bit (IF) in the flag word. All 224 user-defined interrupt 
sources can share this Input, yet they can retain separate 
interrupt handlers. An 8-bit vector read by the CPU during the 
interrupt acknowledge sequence (discussed in System Inter- 
face section) identifies the source of the interrupt. 

Further maskable interrupts are disabled while servicing an 
interrupt by resetting the IF but as part of the response to an 
interrupt or exception. The saved flag word will reflect the 
enable status of the processor prior to the interrupt. Until the 



flag word is restored to the flag register, the interrupt flag will 
be zero unless specifically set. The interrupt return Instruction 
includes restoring the flag word, thereby restoring the original 
status of IF. 

Non-Maskable Interrupt Request (NMI) 

A non-maskable interrupt input (NMI) is also provided. NMI 
has higher priority than INTR. A typical use of NMI would be to 
activate a power failure routine. The activation of this input 
causes an interrupt with an internally supplied vector value of 
2. No external interrupt acknowledge sequence is performed. 

While executing the NMI servicing procedure, the 80286 will 
not service further NMI requests, INTR requests, or the 
processor extension segment overrun interrupt until an inter- 
rupt return (IRET) instruction is executed or the CPU is reset. If 
NMI occurs while currently servicing an NMI, its presence will 
be saved for servicing after executing the first IRET instruc- 
tion. IF is cleared at the beginning of an NMI interrupt to inhibit 
INTR Interrupts. 

Single Step Interrupt 

The 80286 has an internal interrupt that allows programs to 
execute one instruction at a time. It is called the single step 
interrupt and is controlled by the single step flag bit (TF) in the 
flag word. Once this bit is set, an internal single step interrupt 
will occur after the next instruction has been executed. The 
interrupt clears the TF bit and uses an internally supplied 
vector of 1. The IRET instruction is used to set the TF bit and 
transfer control to the next instruction to be single stepped. 

Interrupt Priorities 

When simultaneous interrupt requests occur, they are pro- 
cessed in a fixed order as shown in Table 4. Interrupt 
processing involves saving the flags, return address, and 
setting CS:IP to point at the first instruction of the interrupt 
handler. If other interrupts remain enabled, they are processed 
before the first instruction of the current interrupt handler is 
executed. The last interrupt processed is therefore the first 
one serviced. 
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Table 4. Interrupt Processing Order 



Table 6. MSW Bit Functions 



Order 


interrupt 


1 


INT instruction or exception 


2 


Single step 


3 


NMI 


4 


Processor extension segment overrun 


5 


INTR 



Initialization and Processor Reset 

Processor initialization or start up is accomplished by driving 
the RESET input pin HIGH. RESET forces the 80286 to 
terminate all execution and local bus activity. No instruction or 
bus activity will occur as long as RESET is active. After RESET 
becomes inactive and an internal processing interval elapses, 
the 80286 begins execution in real address mode with the 
instruction at physical location FFFFFO(H). RESET also sets 
some registers to predefined values as shown in Table 5. 

Table 5. 80286 Initial Register State after RESET 



Flag word 


0002(H) 


Machine Status Word 


FFFO(H) 


Instruction pointer 


FFFO(H) 


Code segment 


FOOO(H) 


Data segment 


0000(H) 


Extra segment 


OOOQ(H) 


Stack segment 


0000(H) 



Machine Status Word Description 

The machine status word (MSW) records when a task switch 
takes place and controls the operating mode of the 80286. It is 
a 1 6-bit register of which the lower four bits are used. One bit 
places the CPU into protected mode, while the other three 
bits, as shown in Table 6, control the processor extension 
interface. After RESET, this register contains FFFO(H) which 
places the 80286 in iARX 86 real address mode. 



Bit 
Position 


Name 


Function 





PE 


Protected mode Enable places the 
80286 into protected mode and cannot 
be cleared except by RESET. 


1 


MP 


Monitor Processor extension allows 
WAIT instructions to cause a processor 
extension not present exception 
(number 7). 


2 


EM 


Emulate processor extension causes a 
processor extension not present 
exception (number 7) on ESC 
instructions to allow emulating a 
processor extension. 


3 


TS 


Task Switched indicates the next 
instruction using a processor extension 
will cause exception 7, allowing 
software to test whether the current 
processor extension context belongs to 
the current task. 



The LMSW and SMSW instructions can load and store the 
MSW in real address mode. The recommended use of TS, EM, 
and MP is shown in Table 7. 

Halt 

The HLT instruction stops program execution and prevents 
the CPU from using the local bus until restarted. Either NMI, 
INTR with IF = 1 , or RESET will force the 80286 out of halt. If 
interrupted, the saved CS:IP will point to the next instruction 
after the HLT. 

iAPX 86 Real Address Mode 

The 80286 executes a fully upward-compatible superset of the 
8086 instruction set in real address mode. In real address 
mode the 80286 is object code compatible with 8086 and 
8088 software. The real address mode architecture (registers 
and addressing modes) is exactly as described in the 80286 
Base Architecture section. 



Table 7. Recommended MSW Encodings For Processor Extension Control 



TS 



MP 



EM 



Recommended Use 



Instructions 

Causing 

Exception 



iAPX 86 real address mode only. Initial encoding after RESET. 80286 operation is 
identical to IAPX 86, 88. 



No processor extension is available. Software will emulate its function. 

No processor extension is available. Software will emulate its function. The current 
processor extension context may belong to another task. 



None 



ESC 



ESC 



A processor extension exists. 



None 



A processor extension exists. The current processor extension context may belong 
to another task. The exception on WAIT allows software to test for an error pending 
from a previous processor extension operation. 



ESC or WAIT 



13 



Memory Size 

Physical memory is a contiguous array of up to 1,048,576 
bytes (one megabyte) addressed by pins Aq tlirough A19 and 
BHE. A20 tlirougli A23 are ignored. 

Memory Addressing 

In real address mode the processor generates 20-bit physical 
addresses directly from a 20-bit segment base address and a 
16-bit offset. 

The selector portion of a pointer is interpreted as the upper 1 6 
bits of a 20-bit segment address. The lower four bits of the 20- 
bit segment address are always zero. Segment addresses, 
therefore, begin on multiples of 16 bytes. See Figure 13 for a 
graphic representation of address formation. 



All segments in real address mode are 64K bytes in size and 
may be read, written, or executed. An exception or interrupt 
can occur if data operands or instructions attempt to wrap 
around the end of a segment (e.g. a word with its low order 
byte at offset FFFF(H) and its high order byte at offset 
0000(H)). If, in real address mode, the information contained in 
a segment does not use the full 64K bytes, the unused end of 
the segment may be overlayed by another segment to reduce 
physical memory requirements. 

Reserved Memory Locations 

The 80286 reserves two fixed areas of memory in real address 
mode (see Figure 14): system initialization area and interrupt 
table area. Locations from addresses FFFFO(H) through 
FFFFF(H) are reserved for system initialization. Initial execu- 
tion begins at location FFFFO(H). Locations 00000(H) through 
003FF(H) are reserved for interrupt vectors. 
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Figure 13. iAPX 86 Real Address Mode 
Address Calcuiatlon 
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Figure 14. iAPX 86 Reai Address Mode Ini- 
tlaiiy Reserved Memory Locations 



Tabie 8. Reai Address Mode Addressing interrupts 



Function 



Interrupt 
Number 



Related 
Instructions 



Return Address 
Before Instruction? 



Interrupt table limit too small exception 



INT vector is not within table limit 



Yes 



Processor extension segment overrun interrupt 



ESC with memory operand extending 
beyond offset FFFF(H) 



No 



Segment overrun exception 



Word memory reference with 

offset = FFFF(H) or an attempt to execute 

past the end of a segment 



Yes 



Interrupts 

Table 8 shows the interrupt vectors reserved for exceptions 
and interrupts which indicate an addressing error. The excep- 
tions leave the CPU in the state existing before attempting to 
execute the failing instruction (except for PUSH, POP, PUSHA, 
or POPA). Refer to the next section on protected mode 
initialization for a discussion on exception 8. 

Protected Mode Initialization 

To prepare the 80286 for protected mode, the LIDT instruction 
is used to load the 24-bit interrupt table base and 16-bit limit 
for the protected mode interrupt table. This instruction can 
also set a base and limit for the interrupt vector table in real 
address mode. After reset, the interrupt table base is initialized 
to 000000(H) and its size set to 03FF(H). These values are 
compatible with iAPX 86, 88 software. LIDT should only be 
executed in preparation for the protected mode. 

Shutdown 

Shutdown occurs when a severe error is detected that 
prevents further instruction processing by the CPU. Shutdown 
and halt are externally signalled via a halt bus operation. They 
can be distinguished by Ai HIGH for halt and Ai LOW for 
shutdown. In real address mode, shutdown can occur under 
two conditions: 
o Exceptions 8 or 13 happen and the IDT limit does not 

include the interrupt vector. 
o A CALL, INT, or POP instruction attempts to wrap around 

the stack segment when SP is not even. 

An Nl^l input can bring the CPU out of shutdown if the IDT 
limit is at least OOOF(H) and SP is greater than 0005(H); 
otherwise, shutdown can only be exited via the RESET input. 

Protected Virtual Address Mode 

The 60286 executes a fully upward-compatible superset of the 
8086 instruction set in protected virtual address mode (pro- 
tected mode). Protected mode also provides memory man- 
agement and protection mechanisms and associated instruc- 
tions. 

The 80286 enters protected virtual address mode from real 
address mode by setting the PE (Protection Enable) bit of the 
machine status word with the Load Ivlachine Status Word 
(LIvlSW) instruction. Protected mode offers extended physical 
and virtual memory address space, memory protection mecha- 
nisms, and new operations to support operating systems and 
virtual memory. 

All registers, instructions, and addressing modes described in 
the 80286 Base Architecture section remain the same. Pro- 
grams for the IAPX 86, 88, 186, and real address mode 80286 
can be run in protected mode; however, embedded constants 
for segment selectors are different. 

Memory Size 

The protected mode 80286 provides a 1 gigabyte virtual 
address space per task mapped into a 16-megabyte physical 
address space defined by the address pin A23 - Aq and BHE. 
The virtual address space may be larger than the physical 
address space since any use of an address that does not map 
to a physical memory location will cause a restartable excep- 
tion. 

Memory Addressing 

As in real address mode, protected mode uses 32-bit pointers, 
consisting of 16-bit selector and offset components. The 
selector, however, specifies an index into a memory resident 



table rather than the upper 16-bits of a real memory address. 
The 24-bit base address of the desired segment is obtained 
from the tables in memory. The 16-bit offset is added to the 
segment base address to form the physical address as shown 
in Figure 15. The tables are automatically referenced by the 
CPU whenever a segment register is loaded with a selector. 
All 80286 instructions which load a segment register will 
reference the memory based tables without additional soft- 
ware. The memory based tables contain 8 byte values called 
descriptors. 
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SEGMENT 

DESCRIPTOR 

TABLE 



Figure 15. Protected Mode Memory 
Addressing 

Descriptors 

Descriptors define the use of memory. Special types of 
descriptors also define new functions for transfer of control 
and task switching. The 80286 has segment descriptors for 
code, stack and data segments, and system control descrip- 
tors for special system data segments and control transfer 
operations. Descriptor accesses are performed as locked bus 
operations to assure descriptor integrity in multi-processor 
systems. 

Code and Data Segment Descriptors 

Besides segment base addresses, code and data descriptors 
contain other segment attributes including segment size (1 to 
64K bytes), access rights (read only, read/write, execute only, 
and execute/read), and presence in memory (for virtual 
memory systems)(see Figure 16). Any segment usage violat- 
ing a segment attribute indicated by the segment descriptor 
will prevent the memory cycle and cause an exception or 
interrupt. 
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Access Rights Byte Definition 



Bit 
Position 



Name 



Function 



7 
6-6 



Present (P) 

Descriptor Privilege 
Level (DPL) 

Segment Descriptor (S) 



P = 1 Segment is mapped into ptiysical memory. 

P = No mapping to ptiysical memory exists; base and limit are not used. 
Segment privilege attribute used in privilege tests. 

S = 1 Code or Data segment descriptor 
8 = Non-segment descriptor 



Type 

Field 

Definition 



Executable (E) 
Expansion Direction 
(ED) 



Writable (W) 



E = Data segment descriptor type is; 

ED = Grow up segment, offsets must be < limit. 

ED = 1 Grow down segment, offsets must be > limit. 
W = Data segment may not be written into. 
W = 1 Data segment may be written into. 



Executable (E) 
Conforming (C) 

Readable (R) 



E = 1 Code Segment Descriptor type is: 

C = 1 Code segment may only be executed when 

CPL > DPL. 
R = Code segment may not be read. 
R = 1 Code segment may be read. 



Data 
Segment 



Code 
Segment 



Accessed (A) 



A = Segment has not been accessed. 

A = 1 Segment selector has been loaded into segment register or used by selector 
test instructions. 



Figure 16. Code and Data Segment Descriptors 



Code and data are stored in two types of segments: code 
segments and data segments. Both types are identified and 
defined by segment descriptors. Code segments are identified 
by the executable (E) bit set to 1 in the descriptor access 
rights byte. The access rights byte of both code and data 
segment descriptor types have three fields in common: 
present (P) bit, Descriptor Privilege Level (DPL), and accessed 
(A) bit. If P = 0, any attempted use of this segment will cause a 
not-present exception. DPL specifies the privilege level of the 
segment descriptor. DPL controls when the descriptor may be 
used by a task (refer to privilege discussion). The A bit shows 
whether the segment has been previously accessed for usage 
profiling, a necessity for virtual memory systems. The CPU will 
always set this bit when accessing the descriptor. 

Data segments (S = 1 , E = 0) may be either read-only or read- 
write as controlled by the W bit of the access rights byte. 
Read-only (W = 0) data segments may not be written into. 
Data segments may grow in two directions, as determined by 
the Expansion Direction (ED) bit: upwards (ED = 0) for data 
segments, and downwards (ED = 1) for a segment containing 
a stack. The limit field for a data segment descriptor is 
interpreted differently depending on the ED bit (see Figure 1 6). 

A code segment (S = 1, E = 1) may be execute-only or 
execute/read as determined by the Readable (R) bit. Code 
segments may never be written into and execute-only code 
segments (R = 0) may not be read. A code segment may also 
have an attribute called Conforming (C). A conforming code 
segment may be shared by programs that execute at different 
privilege levels. The DPL of a conforming code segment 
defines the range of privilege levels at which the segment may 
be executed (refer to privilege discussion). 

System Control Descriptors 

In addition to code and data segment descriptors, the protect- 
ed mode 80286 defines system control descriptors. These 
descriptors define special system data segments and control 
transfer mechanisms in the protected environment. The spe- 
cial system data segment descriptors define segments which 
contain tables of descriptors (Local Descriptor Table Descrip- 
tor) and segments which contain the execution state of a task 
(Task State Segment Descriptor). 



The control transfer descriptors are call gates, task gates, 
interrupt gates and trap gates. Gates provide a level of 
indirection between the source and destination of the control 
transfer. This indirection allows the CPU to automatically 
perform protection checks and control the entry point of the 
destination. Call gates are used to change privilege levels (see 
Privilege); task gates are used to perform a task switch; and 
interrupt and trap gates are used to specify interrupt service 
routines. The interrupt gate disables interrupts (resets IF) while 
the trap gate does not. 
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System Segment Descriptor Fields 



Name 


Value 


Description 


TYPE 


1 
2 
3 


Available Task State Segment 
Local Descriptor Table Descriptor 
Busy Task State Segment 


P 




1 


Descriptor contents are not valid 
Descriptor contents are valid 


DPL 


0-3 


Descriptor Privilege Level 


BASE 


24-bit 
number 


Base Address of special system data 
segment in real memory 


LIMIT 


16-bit 
number 


Offset of last byte in segment 



Figure 17. System Segment Format 
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Figure 17 gives tlie formats for the special system data 
segment descriptors. The descriptors contain a 24-bit base 
address of the segment and a 16-bit limit. The access byte 
defines the type of descriptor, its state and privilege level. The 
descriptor contents are valid and the segment is in physical 
memory if P = 1. If P = 0, the segment is not valid. The DPL 
field is only used in Task State Segment descriptors and 
indicates the privilege level at which the descriptor may be 
used (see Privilege). Since the Local Descriptor Table descrip- 
tor may only be used by a special privileged instruction, the 
DPL field is not used. Bit 4 of the access byte is to indicate 
that it is a system control descriptor. The Type field specifies 
the descriptor type as indicated in Figure 17. 

Figure 18 shows the format of the gate descriptors. The 
descriptor contains a destination pointer that points to the 
descriptor of the target segment and the entry point offset. 
The destination selector in an interrupt gate, trap gate, and call 
gate must refer to a code segment descriptor. These gate 
descriptors contain the entry point to prevent a program from 
constructing and using an illegal entry point. Task gates may 
only refer to a task state segment. Since task gates invoke a 
task switch, the destination offset is not used in the task gate. 

Exception 13 is generated when the gate is used if a 
destination selector does not refer to the correct descriptor 
type. The Word Count field is used in the call gate descriptor 
to indicate the number of parameters (0-31 words) to be 
automatically copied from the caller's stack to the stack of the 
called routine when a control transfer changes privilege levels. 
The Word Count field is not used by any other gate descriptor. 



+ 7 


RESE 


1 

RVED- 


t5 


P 


OPL 

1 





TYPE 
1 1 1 


XXX 

1 1 


WORD 
COUNT4-0 


+ 3 


DESTINATION SELECTOR15-2 


X X 
1 


+ 1 


DESTINATION OFFSETis-,, 

1 
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Gate Descriptor Fields 



Name 


Value 


Description 


TYPE 


4 
5 
6 

7 


-Call Gate 
-Task Gate 
-Interrupt Gate 
-Trap Gate 


P 



1 


-Descriptor Contents are not 
valid 
-Descriptor Contents are valid 


DPL 


0-3 


Descriptor Privilege Level 


WORD 
COUNT 


0-31 


Number of words to copy from 
callers stack to called 
procedures stack. Only used 
with call gate. 


DESTINATION 
SELECTOR 


16-bit 
selector 


Selector to the target code 
segment (Call, Interrupt or 
Trap Gate) 

Selector to the target task 
state segment (Task Gate) 


DESTINATION 
OFFSET 


16-bit 
offset 


Entry point within the target 
code segment 



Figure 18. Gate Descriptor Format 



The access byte format is the same for all gate descriptors. 
P = 1 indicates that the gate contents are valid. P = indi- 
cates the contents are not valid and causes exception 1 1 if 
referenced. DPL is the Descriptor Privilege Level and specifies 
when this descriptor may be used by a task (refer to privilege 
discussion). Bit 4 must equal to indicate a system control 
descriptor. The Type field specifies the descriptor type as 
indicated in Figure 18. 

Segment Descriptor Cactie Registers 

A segment descriptor cache register is assigned to each of the 
four segment registers (CS, SS, DS, ES). Segment descriptors 
are automatically loaded (cached) into a segment descriptor 
cache register (Figure 20) whenever the associated segment 
register is loaded with a selector. Only segment descriptors 
may be loaded into segment descriptor cache registers. Once 
loaded, all references to that segment of memory use the 
cached descriptor information instead of reaccessing memory. 
The descriptor cache registers are not visible to programs. No 
instructions exist to store their contents. They only change 
when a segment register is loaded. 

Selector Fields 

A protected mode selector has three fields: descriptor entry 
index, local or global descriptor table indicator (Tl), and 
selector privilege (RPL) as shown in Figure 19. These fields 
select one of two memory based tables of descriptors, select 
the appropriate table entry and allow high-speed testing of the 
selector's privilege attribute (refer to privilege discussion). 

SELECTOR 



PRL 



Bits 


Name 


Function 


1 -0 


REQUESTED 
PRIVILEGE 
LEVEL 
(RPL) 


INDICATES SELECTOR PRIVILEGE 
LEVEL DESIRED 


2 


TABLE 

INDICATOR 

(Tl) 


Tl = USE GLOBAL DESCRIPTOR TABLE 

(GDT) 
Tl = 1 USE LOCAL DESCRIPTOR TABLE 

(LDT) 


15-3 


INDEX 


SELECT DESCRIPTOR ENTRY IN TABLE 



Figure 19. Selector Fields 
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PROQRAM VISIBLE 
SEGMENT SELECTORS 



CS 




DS 




SS 




ES 





r^ 



PROGRAM INVISIBLE 



ACCESS 
RIGHTS 


SEGMENT BASE ADDRESS 


SEGMENT SIZE 



























SEGMENT REGISTERS 
(LOADED BY PROGRAM) 



SEGMENT DESCRIPTOR CACHE REGISTERS 
(LOADED BY CPU) 



I : 



J 

DF003720 



Figure 20. Descriptor Cache Registers 



Local and Global Descriptor Tables 



Two tables of descriptors, called descriptor tables, contain all 
descriptors accessible by a task at any given time. A descrip- 
tor table is a linear array of up to 81 92 descriptors. The upper 
13 bits of the selector value are an index into a descriptor 
table. Each table has a 24-bit base register to locate the 
descriptor table in physical memory and a 16-bit limit register 
that confines descriptor access to the defined limits of the 
table as shown in Figure 21. A restartable exception (13) will 
occur if an attempt is made to reference a descriptor outside 
the table limits. 

One table, called the Global Descriptor Table (GDT), contains 
descriptors available to all tasks. The other table, called the 
Local Descriptor Table (LDT), contains descriptors that can be 
private to a task. Each task may have its own private LDT. The 
GDT may contain all descriptor types except interrupt and trap 
descriptors. The LDT may contain only segment, task gate, 
and call gate descriptors. A segment cannot be accessed by a 
task if its segment descriptor does not exist in either descriptor 
table at the time of access. 



instruction loads a selector which refers to a descriptor in the 
Local Descriptor Table. This descriptor contains the base 
address and limit for an LDT, as shown in Figure 17. 



LDT 
SELECTOR 



PROGRAM INVISIBLE 
L i 



1 



CURRENT 
'LDT 



+ 5 


RESERVED- 


BASE23-,6 


+ 4 


+ 3 


BASE,5-o 

1 


+ 2 


+ 1 


LIMITiM 

1 
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Figure 22. Global Descriptor Table and Inter- 
rupt Descriptor Data Type 

■Must be set to for compatibility with iAPX 386, 

Interrupt Descriptor Table 

The protected mode 80286 has a third descriptor table, called 
the Interrupt Descriptor Table (IDT) (see Figure 23), used to 
define up to 256 interrupts. It may contain only task gates, 
interrupt gates and trap gates. The IDT (Interrupt Descriptor 
Table) has a 24-bit base and 16-bit limit register in the CPU. 
The protected LIDT instruction loads these registers with a 
six-byte value of identical form to that of the LGDT instruction 
(see Figure 22 and Protected Mode Initialization). 






GATE FOR 
INTERRUPT #n 



GATE FOR 
INTERRUPT #n-1 



GATE FOR 
INTERRUPT #1 



GATE FOR 
INTERRUPT #0 



INTERRUPT 
V DESCRIPTOR 
' TABLE 

(IDT) 



Figure 21. Local and Global Descriptor 
Table Definition 

The LGDT and LLDT instructions load the base and limit of the 
global and local descriptor tables. LGDT and LLDT are 
protected. They may only be executed by trusted programs 
operating at level 0. The LGDT instruction loads a six byte field 
containing the 16-bit table limit and 24-bit base address of the 
Global Descriptor Table as shown in Figure 22. The LLDT 



Figure 23. Interrupt Descriptor Table 
Definition 

References to IDT entries are made via INT instructions, 
external interrupt vectors, or exceptions. The IDT must be at 
least 256 bytes in size to allocate space for all reserved 
interrupts. 
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Privilege 

The 80286 has a four-level hierarchical privilege system which 
controls the use of privileged instructions and access to 
descriptors (and their associated segments) within a task. 
Four-level privilege, as shown in Figure 24, is an extension of 
the user/supervisor mode commonly found in minicomputers. 
The privilege levels are numbered through 3. Level is the 
most privileged level. Privilege levels provide protection within 
a task. (Tasks are isolated by providing private LDT's for each 
task.) Operating system routines, interrupt handlers, and other 
system software can be included and protected within the 
virtual address space of each task using the four levels of 
privilege. Tasks may also have a separate stack for each 
privilege level. 

Tasks, descriptors, and selectors have a privilege level 
attribute that determines whether the descriptor may be used. 
Task privilege effects the use of instructions and descriptors. 
Descriptor and selector privilege only effect access to the 
descriptor. 



CPU 

ENFORCED 
SOFTWARE 
INTERFACES 




Figure 24. Hierarchical Privilege Levels 
Task Privilege 

The task always executes at one of the four privilege levels. A 
task privilege level at any specific instant is called the Current 
Privilege Level (CPL) and is defined by the lower two bits of 
the CS register. CPL cannot change during execution in a 
single code segment. A task's CPL may only be changed by 
control transfers through gate descriptors to a new code 
segment (See Control Transfer). Tasks begin executing at the 
CPL value specified by the code segment when the task is 
initiated via a task switch operation. A task executing at Level 
can access all data segments defined in the GDT and the 
task's LDT and is considered the most trusted level. A task 
executed at Level 3 has the most restricted access to data 
and is considered the least trusted level. 

Descriptor Privilege 

Descriptor privilege is specified by the Descriptor Privilege 
Level (DPL) field of the descriptor access byte. DPL specifies 
the least trusted privilege level (CPL) at which a task may 
access the descriptor. Descriptors with DPL = are the most 
protected. Only tasks executing at privilege level (CPL = 0) 
may access them. Descriptors with DPL = 3 are the least 
protected (i.e. have the least restricted access) since tasks 
can access them when CPL = 0, 1 , 2, or 3. This rule applies to 
all descriptors, except LDT descriptors. 



Selector Privilege 

Selector privilege is specified by the Requested Privilege 
Level (RPL) field in the least significant two bits of a selector. 
Selector RPL may establish a less trusted privilege level than 
the current privilege level for the use of a selector. This level is 
called the task's effective privilege level (EPL). RPL can only 
reduce the scope of a task's access to data with this selector. 
A task's effective privilege is the numeric maximum of RPL 
and CPL. A selector with RPL = imposes no additional 
restriction on its use while a selector with RPL = 3 can only 
refer to segments at privilege Level 3 regardless of the task's 
CPL. RPL is generally used to verify that pointer parameters 
passed to a more trusted procedure are not allowed to use 
data at a more privileged level than the caller (refer to pointer 
testing instructions). 

Descriptor Access and Privilege Validation 

Determining the ability of a task to access a segment involves 
the type of segment to be accessed, the instruction used, the 
type of descriptor used and CPL, RPL, and DPL. The two basic 
types of segment accesses are control transfer (selectors 
loaded into CS) and data (selectors loaded into DS, ES or SS). 

Data Segment Access 

Instructions that load selectors into DS and ES must refer to a 
data segment descriptor or readable code segment descriptor. 
The CPL of the task and the RPL of the selector must be the 
same as or more privileged (numerically equal to or lower 
than) than the descriptor DPL. In general, a task can only 
access data segments at the same or less privileged levels 
than the CPL or RPL (whichever is numerically higher) to 
prevent a program from accessing data it cannot be trusted to 
use. 

An exception to the rule is a readable conforming code 
segment. This type of code segment can be read from any 
privilege level. 

If the privilege checks fail (e.g. DPL is numerically less than 
the maximum of CPL and RPL) or an incorrect type of 
descriptor is referenced (e.g. gate descriptor or execute only 
code segment), exception 13 occurs. If the segment is not 
present, exception 11 is generated. 

Instructions that load selectors into SS must refer to data 
segment descriptors for writable data segments. The descrip- 
tor privilege (DPL) and RPL must equal CPL. All other 
descriptor types or privilege level violation will cause exception 
13. A not present fault causes exception 12. 

Control Transfer 

Four types of control transfer can occur when a selector is 
loaded into CS by a control transfer operation (see Table 10). 
Each transfer type can only occur if the operation which 
loaded the selector references the correct descriptor type. 
Any violation of these descriptor usage rules (e.g. JMP 
through a call gate or RET to a Task State Segment) will 
cause exception 13. 

The ability to reference a descriptor for control transfer is also 
subject to rules of privilege. A CALL or JUMP instruction may 
only reference a code segment descriptor with DPL equal to 
the task CPL or a conforming segment with DPL of equal or 
greater privilege than CPL. The RPL of the selector used to 
reference the code descriptor must have as much privilege as 
CPL. 

RET and IRET instructions may only reference code segment 
descriptors with descriptor privilege equal to or less privileged 
than the task CPL. The selector loaded into CS is the return 
address from the stack. After the return, the selector RPL is 
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the task's new CPL. If CPL changes, the old stack pointer is 
popped after the return address. 

When a JMP or CALL references a Task State Segment 
descriptor, the descriptor DPL must be the same or less 
privileged than the task's CPL. Reference to a valid Task State 
Segment descriptor causes a task switch (see Task Switch 
Operation). Reference to a Task State Segment descriptor at 
a more privileged level than the task's CPL generates excep- 
tion 13. 

When an instruction or interrupt references a gate descriptor, 
the gate DPL must have the same or less privilege than the 
task CPL. If DPL is at a more privileged level than CPL, 
exception 13 occurs. If the destination selector contained in 
the gate references a code segment descriptor, the code 
segment descriptor DPL must be the same or more privileged 
than the task CPL. If not. Exception 1 3 is issued. After the 
control transfer, the code segment descriptor DPL is the task's 
new CPL. If the destination selector in the gate references a 



task state segment, a task switch is automatically performed 
(see Task Switch Operation). 

The privilege rules on control transfer require: 

- JMP or CALL direct to a code segment (code segment 
descriptor) can only be to a conforming segment with DPL of 
equal or greater privilege than CPL or a non-conforming 
segment at the same privilege level. 

- interrupts within the task or calls that may change privilege 
levels can only transfer control through a gate at the same or a 
less privileged level than CPL to a code segment at the same 
or more privileged level than CPL. 

- return instructions that don't switch tasks can only return 
control to a code segment at the same or less privileged level. 

- task switch can be performed by a call, a jump or an interrupt 
which references either a task gate or task state segment at 
the same or less privileged level. 



Table 9. Descriptor Types Used for Control Transfer 



Control Transfer Types 



Operation Types 



Descriptor 
Referenced 



Descriptor 
Table 



Intersegment within the same privilege level 



JMP, CALL, RET, 
IRET* 



Code Segment 



GDT/LDT 



Intersegment to the same or higher privilege level Interrupt 
within task may change CPL. 



CALL 



Call Gate 



GDT/LDT 



Interrupt Instruction, 
Exception, External 
Interrupt 



Trap or 
Interrupt 
Gate 



IDT 



Intersegment to a lower privilege level (changes task CPL) 



RET, IRET* 



Code Segment 



GDT/LDT 



CALL, JMP 



Task State 
Segment 



GDT 



Task Switch 



CALL, JMP 



Task Gate 



GDT/LDT 



IRET 

Interrupt Instruction, 

Exception, External 

Interrupt 



Task Gate 



IDT 



, NT (Nested Task bit of flag word) = 
*NT (Nested Task bit of flag word) = 1 



Privilege Level Changes 

Any control transfer that changes CPL within the task causes 
a change of stacks as part of the operation. Initial values of 
SS:SP for privilege levels 0, 1 , and 2 are kept in the task state 
segment (refer to Task Switch Operation). During a JMP or 
CALL control transfer, the new stack pointer is loaded into the 
SS and SP registers and the previous stack pointer is pushed 
onto the new stack. 

When returning to the original privilege level, its stack is 
restored as part of the RET or IRET instruction operation. For 
subroutine calls that pass parameters on the stack and cross 
privilege levels, a fixed number of words, as specified in the 
gate, are copied from the previous stack to the current stack. 
The intersegment RET instruction with a stack adjustment 
value will correctly restore the previous stack pointer upon 
return. 

Protection 

The 80286 includes mechanisms to protect critical instructions 
that affect the CPU execution state (e.g. HLT) and code or 
data segments from improper usage. These mechanisms are 
grouped under the term "protection" and have three forms: 



Restricted usage of segments (e.g. no write allowed to read- 
only data segments). The only segments available for use 
are defined by descriptors in the Local Descriptor Table 
(LDT) and Global Descriptor Table (GDT). 

Restricted access to segments via the rules of privilege and 
descriptor usage. 

Privileged instructions or operations that may only be 
executed at certain privilege levels as determined by the 
CPL and I/O Privilege Level (lOPL). The lOPL is defined by 
bits 14 and 13 of the flag word. 

These checks are performed for all instructions and can be 
split into three categories: segment load checks (Table 10), 
operand reference checks (Table 11), and privileged instruc- 
tion checks (Table 12). Any violation of the rules shown will 
result in an exception. A not-present exception related to the 
stack segment causes exception 12. 

The IRET and POPF instructions do not perform some of their 
defined functions if CPL is not of sufficient privilege (numeri- 
cally small enough). No exceptions or other indication are 
given when these conditions occur. 

The IF bit is not changed if CPL > lOPL 

The lOPL field of the flag word is not changed if 

CPL > 0. 



20 



Table 10. Segment Register Load Checks 



Error Description 


Exception 
Number 


Descriptor table limit exceeded 


13 


Segment descriptor not-present 


11 or 12 


Privilege rules violated 


13 


Invalid descriptor/segment type segment 
register load: 
—Read only data segment load to SS 
—Special control descriptor load to DS, 

ES, SS 
—Execute only segment load to DS, ES, 

SS 
—Data segment load to CS 
—Read/Execute code segment load to 

SS 


13 



Table 12. Privileged Instruction Checks 



Error Description 


Exception 
Number 


CPL=i<=0 VKhen executing the folloviring 
instructions: 

LIDT, LLDT, LGDT, LTR, LMSW, CTS, 

HLT 


13 


CPL > lOPL when executing the following 
instructions: 

INS, IN, OUTS, OUT, STI, CLI, LOCK 


13 



Table 11. Operand Reference Checks 



Error Description 


Exception 
Number 


Write into code segment 


13 


Read from execute-only code segment 


13 


Write to read-only data segment 


13 


Segment limit exceeded' 


12 or 13 



Note 1: Carry out in offset calculations is ignored. 



Exceptions 

The 80286 detects several types of exceptions and interrupts 
in protected mode (see Table 13). IVIost are restartable after 
the exceptional condition is removed. Interrupt handiers for 
most exceptions receive an error code, pushed on the stacl< 
after the return address, that identifies the selector involved (0 
if none). The return address normally points to the failing 
instruction, including all leading prefixes. For a processor 
extension segment overrun exception, the return address will 
not point at the ESC instruction that caused the exception; 
however, the processor extension registers may contain the 
address of the failing instruction. 



Table 13. Protected Mode Exceptions 



Interrupt 
Vector 



Function 



Return 






Address 


Always 


Error 

Code 

on Stack? 


At Failing 
Instruction? 


Restartable? 


Yes 


No 


Yes 


No 


No 


No 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes' 


Yes 


Yes 


No 


Yes 



10 

11 

12 
13 



Double exception detected 

Processor extension segment overrun 

Invalid task state segment 

Segment not present 

Stack segment overrun or segment not present 

General protection 



Note 1: When a PUSHA or POPA instruction attempts to wrap around the stack segment, the machine state after the exception will not 
be restartable. This condition is identified by the value of the saved SP being either 0000(H), 0001(H), FFFE(H), or FFFF(H). 



All these checks are performed for all instructions and can be 
split into three categories: segment load checks (Table 11), 
operand reference checks (Table 12), and privileged instruc- 
tion checks (Table 13). Any violation of the rules shown will 
result in an exception. A not-present exception related to the 
stack segment causes exception 12. 

Special Operations 

Task Switch Operation 

The 80286 provides a built-in task switch operation which 
saves the entire 80286 execution state (registers, address 
space, and a link to the previous task), loads a new execution 
state, and commences execution in the new task. Like gates, 
the task switch operation is invoked by executing an inter- 
segment JMP or CALL instruction which refers to a Task State 
Segment (TSS) or task gate descriptor in the GDT or LDT. An 
INT n instruction, exception, or external interrupt may also 
invoke the task switch operation by selecting a task gate 
descriptor in the associated IDT descriptor entry. 

The TSS descriptor points at a segment (see Figure 25) 
containing the entire 80286 execution state while a task gate 
descriptor contains a TSS selector. The limit field must 
be > 002B(H). 

Each task must have a TSS associated with it. The current 
TSS is identified by a special register in the 80286 called the 



Task Register (TR). This register contains a selector referring 
to the task state segment descriptor that defines the current 
TSS. A hidden base and limit register associated with TR are 
loaded whenever TR is loaded with a new selector. 

The IRET instruction is used to return control to the task that 
called the current task or was interrupted. Bit 1 4 in the flag 
register is called the Nested Task (NT) bit. It controls the 
function of the IRET instruction. If NT = O, the IRET instruc- 
tion performs the regular current task return; when NT = 1 , 
IRET performs a task switch operation back to the previous 
task. 

When a CALL or INT instruction initiates a task switch, the old 
and new TSS will be marked busy and the back link field of the 
new TSS set to the old TSS selector. The NT bit of the new 
task is set by CALL or INT initiated task switches. An interrupt 
that does not cause a task switch will clear NT. NT may also 
be set or cleared by POPF or IRET instructions. 

The task state segment is marked busy by changing the 
descriptor type field from Type 1 to Type 3. Use of a selector 
that references a busy task state segment causes Exception 
13. 

Processor Extension Context Switching 

The context of a processor extension is not changed by the 
task switch operation. A processor extension context need 
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only be changed when a different task attempts to use the 
processor extension (which still contains the context of a 
previous task). The 80286 detects the first use of a processor 
extension after a task switch by causing the processor 
extension not present exception (7). The interrupt handler may 
then decide whether a context change is necessary. 

Whenever the 80286 switches tasks, it sets the Task Switched 
(TS) bit of the MSW. TS indicates that a processor extension 
context may belong to a different task than the current one. 
The processor extension not present exception (7) will occur 
when attempting to execute an ESC or WAIT instruction if 



TS = 1 and a processor extension is present (MP = 1 in 
MSW). 

Pointer Testing Instructions 

The 80286 provides several instructions to speed pointer 
testing and consistency checks for maintaining system integri- 
ty (see Table 14). These instructions use the memory manage- 
ment hardware to verify that a selector value refers to an 
appropriate segment without risking an exception. A condition 
flag indicates whether use of the selector or segment will 
cause an exception. 



TASX REGISTER 
TR 



}--- 



PROGRAM INVISIBLE 
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DCSCfillTOA 
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STATE 
SEGMENT 



BASEZ3-16 



BASEiM 
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I 



TASK LOT SELECTOR 



IP (ENTRY POINT) 



_ J 



TYPE 


DESCRIPTION 


1 


AN AVAILABLE TASK STATE 
SEGMCNT.HAYBEUSEDAS 
THC OESTMATKW Of A TASK 
SWITCH OPERATION. 


3 


A BUSYTASKSTAn SEGMENT. 
CANNOT BE USED AS THE 
DESTINATION Of A TASK 
SWITCH. 



BACK UNK SELECTOR TO TSS 



BYTE 

OfPSET 



P DESCRIPTION 
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DEFINED 



CURRENT 
1 TASK 



INITIAL 
STACKS 
FOR CPL 0,1,2 



Figure 25. Tasl< State Segment and TSS Registers 
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Table 14. Pointer Test Instructions 



Instruction 


Operands 


Function 


ARPL 


Selector, 
Register 


Adjust Requested Privilege Level: 
adjusts the RPL of the selector to 
the numeric maximum of current 
selector RPL value and the RPL 
value in the register. Set zero flag 
if selector RPL was changed. 


VERR 


Selector 


VERify for Read: sets the zero 
flag if the segment referred to by 
the selector can be read. 


VERW 


Selector 


VERify for Write: sets the zero 
flag if the segment referred to by 
the selector can be written. 


LSL 


Register, 
Selector 


Load Segment Limit: reads the 
segment limit into the register if 
privilege rules and descriptor type 
allow. Set zero flag if successful. 


LAR 


Register, 
Selector 


Load Access Rights: reads the 
descriptor access rights byte into 
the register if privilege rules allow. 
Set zero flag if successful. 



Double Fault and Shutdown 

If two separate exceptions are detected during a single 
instruction execution, the 80286 performs the double fault 
exception (8). If an exception occurs during processing of the 
double fault exception, the 80286 will enter shutdown. During 
shutdown no further instructions or exceptions are processed. 
Either NMI (CPU remains in protected mode) or RESET (CPU 
exits protected mode) can force the 80286 out of shutdown. 
Shutdown is externally signalled via a HALT bus operation with 
Ai HIGH. 

Protected iUlode Initialization 

The 80286 initially executes in real address mode after 
RESET. To allow initialization code to be placed at the top of 
physical memory, A23_2o will be HIGH when the 80286 
performs memory references relative to the CS register, until 
OS is changed. A23-20 will be zero for references to the DS, 
ES, or SS segments. Changing CS in real address mode will 
force A23 - A20 LOW whenever using CS thereafter. The initial 
CS:IP value of FFOO:FFFO provides 64K bytes of code space 
for initialization code without changing CS. 

Before placing the 80286 into protected mode, several regis- 
ters must be initialized. The GDT and IDT base registers must 
refer to a valid GDT and IDT. After executing the LMSW 
instruction to set PE, the 80286 must immediately execute an 
intrasegment JMP instruction to clear the instruction queue of 
instructions decoded in real address mode. 

To force the 80286 CPU registers to match the initial protected 
mode state assumed by software, execute a JMP instruction 
with a selector referring to the initial TSS used in the system. 
This will load the task register, local descriptor table register, 
segment registers and initial general register state. The TR 
should point at a valid TSS since a task switch operation 
involves saving the current task state. 



System Interface 

The 80286 system interface appears in two forms: a local bus 
and a system bus. The local bus consists of address, data, 
status, and control signals at the pins of the CPU. A system 
bus is any buffered version of the local bus. A system bus may 
also differ from the local bus in terms of coding of status and 
control lines and/or timing and loading of signals. The 80286 
family includes several devices to generate standard system 
buses such as the IEEE 796 Standard Multibus^*^. 

Bus Interface Signals and Timing 

The 80286 microsystem local bus interfaces the 80286 to 
local memory and I/O components. The interface has 24 
address lines, 16 data lines, and 8 status and control signals. 

The 80286 CPU, 82284 clock generator, 82C288 bus control- 
ler, 82289 bus arbiter, 8286/7 transceivers, and 8282/3 
latches provide a buffered and decoded system bus interface. 
The 82284 generates the system clock and synchronizes 
READY and RESET. The 82C288 converts bus operation 
status encoded by the 80286 into command and bus control 
signals. These components can provide the timing and electri- 
cal power drive levels required for most system bus interfaces 
including the multibus. 

Physical Memory and I/O Interface 

A maximum of 16 megabytes of physical memory can be 
addressed in protected mode. One megabyte can be ad- 
dressed in real address mode. Memory is accessible as bytes 
or words. Words consist of any two consecutive bytes 
addressed with the least significant byte stored in the lowest 
address. 

Byte transfers occur on either half of the 1 6-bit local data bus. 
Even bytes are accessed over Dy-o while odd bytes are 
transferred over Di5_8. Even-addressed words are trans- 
ferred over Di5_o in one bus cycle, while odd-addressed 
words require two bus operations. The first transfers data on 
Di5_8, and the second transfers data on Dy-o. Both byte 
data transfers occur automatically, transparent to software. 

Two bus signals, Aq and SHE, control transfers over the lower 
and upper halves of the data bus. Even address byte transfers 
are indicated by Aq LOW and BHE HIG H. Od d address byte 
tran sfers are indicated by Aq HIGH and BHE LOW. Both Aq 
and BHE are LOW for even address word transfers. 

The I/O address space contains 64K addresses in both 
modes. The I/O space is accessible as either bytes or words, 
as is memory. Byte wide peripheral devices may be attached 
to either the upper or lower byte of the data bus. Byte-wide I/O 
devices attached to the upper data byte (Di5_8) are ac- 
cessed with odd I/O addresses. Devices on the lower data 
byte are accessed with even I/O addresses. An interrupt 
controller such as the 8259A must be connected to the lower 
data byte (D7_o) for proper return of the interrupt vector. 

Bus Operation 

The 80286 uses a double frequency system clock (CLK input) 
to control bus timing. All signals on the local bus are measured 
relative to the system CLK input. The CPU divides the system 
clock by 2 to produce the internal processor clock, which 
determines bus state. Each processor clock is composed of 
two system clock cycles named phase 1 and phase 2. The 
82284 clock generator output (PCLK) identifies the next phase 
of the processor clock. (See Figure 26.) 



Multibus is a registered trademark of Intel Corporation. 
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Figure 26. System and Processor Clock Relationships 



Six types of bus operations are supported: memory read, 
memory write, I/O read, I/O write, interrupt acknowledge, and 
halt/shutdown. Data can be transferred at a maximum rate of 
one word per two processor clock cycles. 

The 80286 bus has three basic states: idle (Tj), send status 
(Ts), and perform command (Tc). The 80286 CPU also has a 



fourth local bus state called hold (Th). Th indicates that the 
80286 has surrendered control of the local bus to another bus 
master in response to a HOLD request. 

Each bus state is one processor clock long. Figure 27 shows 
the four 80286 local bus states and allowed transitions. 
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Figure 27. 80286 Bus States 



Bus States 

The idle (Tj) state indicates that no data transfers are in 
progress or requested. Th e first active state, Ts, is signalled by 
either status line ST or SO going LOW also identifying phase 1 
of the processor clock. During Ts, the command encoding, the 
address, and data (for a write operation) are available on the 
80286 output pins. The 820288 bus controller decodes the 
status signals and generates Multibus compatible read/write 
command and local transceiver control signals. 

After Tg, the perform command (Tg) state is entered. Memory 
or I/O devices respond to the bus operation during Tc, either 
transferring read data to the CPU or accepting write data. To 
states may be repeated as often as necessary to assure 
sufficien t time for the memory or I/O device to respond. The 
READY signal determines whether Tc is repeated. 

During hold (Th), the 80286 will float all address, data, and 
status output pins, enabling another bus master to use the 
local bus. The 80286 HOLD input signal is used to place the 



80286 into the Th state. The 80286 HLDA output signal 
indicates that the CPU has entered Th. 

Pipelined Addressing 

The 80286 uses a local bus interface with pipelined timing to 
allow as much time as possible for data access. Pipelined 
timing allows bus operations to be performed in two processor 
cycles, while allowing each individual bus operation to last for 
three processor cycles. 

The timing of the address outputs is pipelined such that the 
address of the next bus operation becomes available during 
the current bus operation. Or in other words, the first clock of 
the next bus operation is overlapped with the last clock of the 
current bus operation. Therefore, address decode and routing 
logic can operate in advance of the next bus operation. 
External address latches may hold the address stable for the 
entire bus operation and provide additional AC and DC 
buffering. 
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Figure 28. Basic Bus Cycle 



The 80286 does not maintain tiie address of tlie current bus 
operation during ali Tc states. Instead, the address for the next 
bus operation may be emitted during phase 2 of any To- The 
address remains valid during phase 1 of the first To to 
guarantee hold time, relative to ALE, for the address latch 
inputs. 

Bus Control Signals 

The 82C288 bus controller provides control signals: address 
latch enable (ALE), Read/Write commands, data transmit/ 
receive (DT/R), and data enable (DEN) that control the 
address latches, data transceivers, write enable, and output 
enable for memory and I/O systems. 

The Address Latch Enable (ALE) output determines when the 
address may be latched. ALE provides at least one system 
CLK period of address hold time from the end of the previous 
bus operation until the address for the next bus operation 
appears at the latch outputs. This address hold time is 
required to support Multibus® and common memory systems. 

The data bus transceivers are controlled by 82C288_outputs 
Data Enable (DEN) and Data Transmit/Receive (DT/R). DEN 
enables the data transceivers while DT/R controls transceiver 
direction. DEN and DT/R are timed to prevent bus contention 
between the bus master, data bus transceivers, and system 
data bus transceivers. 



Command Timing Controis 

Two system timing customization options, command exten- 
sion and command delay, are provided on the 80286 local 
bus. 

Command extension allows additional time for external de- 
vices to respond to a command and is analogous to inserting 
wait states on the 8086. External logic can control the duration 
of any bus operat ion such that the operation is only as long as 
necessary. The READY input signal can extend any bus 
operation for as long as necessary. 

Command delay allows an increase of address or write data 
set-up time to system bus command active for any bus 
operation by delaying when the system bus command be- 
comes active. Command delay is controlled by the 82C288 
CMDLY input. After Ts, the bus controller samples CMDLY at 
each failing edge of CLK. If CMDLY is HIGH, the 82C288 will 
not activate the command signal. When CMDLY is LOW, the 
82C288 will activate the command signal. After the command 
becomes active, the CMDLY input is not sampled. 

When a command is delayed, the available response time 
from command active to return read data or accept write data 
is less. To customize system bus timing, an address decoder 
can determine which bus operations require delaying the 
command. The CMJDLY input does not affect the timing of 
ALE, DEN, or DT/R. 
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Figure 29. CMDLY Controls and Leading Edge of tlie Command 



Figure 29 illustrates four uses of CMDLY. Example 1 shows 
delaying the read command two system CLKs for cycle N-1 
and no delay for cycle N, and example 2 shows delaying the 
read command one system CLK for cycle N-1 and one system 
CLK delay for cycle N. 

Bus Cycle Termination 

At maximum transfer rates, the 80286 bus alternates between 
the status and command states. The bus status signals 
become inactive after Ts so that they may correctly signal the 
start of the next bus operation after the completion of the 
current cycle. No external indication of Tc exists on the 80286 
local bus. The bus master and bus controller enter To directly 
after Ts and continue executing To cycles until terminated by 
READY. 



of the READY signal, thereby requiring READY be synchro- 
nous to the system clock. 

Synchronous Ready 



READY Operation 

The current bus master and 82C288 bus controller terminate 
each bus operation simultaneously to achieve maximum bus 
bandwidth. Both are informed in advance by READY active 
which identifies the last To cycle of the current bus operation. 
The bus master and bus controller must see the same sense 



The 82284 clock generator provides READY synchronization 
from both synchronous and asynchrono us sou rces (see Fig- 
ure 30). The synchronous ready input (SRDY) of the clock 
generator is sampled with the fallin g edge of CLK at the end of 
phase 1 of each Tc. The state of SRDY i s then b roadcast to 
the bus master and bus controller via the READY output line. 

Asynchronous Ready 

Many systems have devices or subsystems that are asynchro- 
nous to the system clock. As a result, t heir rea dy outputs 
cannot be guaranteed to meet the 82284 SRDY set-up and 
hold tim e requirements. The 82284 asynchronous ready input 
(ARDY) is designed to accept such signals. The ARDY input is 
sampled at the beginning of each To cycle by 82284 synchro- 
nization logic. This provides a system CLK cycle time to 
resolve its value before broadcasting it to the bus master and 
bus controller. 
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Figure 30. Synchronous and Asynchronous Ready 



Notes: 1. SRDYEN is active LOW. 



2. If SRDYE N is HIGH, the state of SRDY will not effect READY. 

3. ARDYEN is active LOW. 



Eac h reaiJy in put of the 82284 has an enable pin (SRDYEN 
and ARDYEN) to select whether the current bus operation will 
be terminate(d by the synchronous or asynchronous ready. 
Either of the ready inputs may terminate a bus operation. 
These enable inputs are active low and have the same timing 
as their respective ready inputs. Address decode logic usually 
selects whether t he curr ent bus operation should be terminat- 
ed by ARDY or SRDY. 

Data Bus Control 

Figures 31 , 32, and 33 show how the DT/R, DEN, data bus, 
and address signals operate for different combinations of 
read, write, and idle bus operations. DT/R goes active (LOW) 
for a read operation. DT/R remains HIGH before, during, and 
between write operations. 

The data bus is driven with write data during the second phase 
of Ts. The delay in write data timing allows the read data 



drivers, from a previous read cycle, sufficient time to enter 
three-state OFF before the 80286 CPU begins driving the local 
data bus for write operations. Write data will always remain 
valid for one system clock past the last Tc to provide sufficient 
hold time for Multibus or other similar memory or I/O systems. 
During write-read or write-idle sequences the data bus enters 
three-state OFF during the second phase of the processor 
cycle after the last Tq. In a write-write sequence the data bus 
does not enter three-state OFF between Tc and Tg. 

Bus Usage 

The 80286 local bus may be used for several functions: 
instruction data transfers, data transfers by other bus masters, 
instruction fetching, processor extension data transfers, inter- 
rupt acknowledge, and halt/shutdown. This section describes 
local bus activities which have special signals or requirements. 
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Figure 32. Back-to-Back Write-Read Cycles 
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Figure 33. Back-to-Back Write-Write Cycles 



HOLD and HLDA 

HOLD and HLDA allow another bus master to gain control of 
the local bus by placing the 80286 bus into the Th state. The 
sequence of events required to pass control between the 
80286 and another local bus master are shown in Figure 34. 

In this example, the 80286 is initially in the Th, state as 
signaled by HLDA being active. Upon leaving Th, as signaled 
by HLDA going inactive, a write operation is started. During the 
write operation another local bus master requests the local 
bus from the 80286 as shown by the HOLD signal. After 
completing the write operation, the 80286 performs one T| bus 
cycle, to guarantee write data hold time, then enters Th as 
signaled by HLDA going active. 



The CMDLY signal and ARDY ready are used t o start a nd stop 
the write bus command, respectively. Note that SR DY mus t be 
inactive or disabled by SRDYEN to guarantee ARDY will 
terminate the cycle. 

Instruction Fetching 

The 80286 Bus Unit (BU) will fetch instructions ahead of the 
current instruction being executed. This activity is called 
prefetching. It occurs when the local bus would othenwise be 
idle and obeys the following rules: 



A prefetch bus operation starts when at least two bytes of the 
6-byte prefetch queue are empty. 

The prefetcher normally performs word prefetches indepen- 
dent of the byte alignment of the code segment base in 
physical memory. 

The prefetcher will perform only a byte code fetch operation 
for control transfers to an instruction beginning on a numeri- 
cally odd physical address. 

Prefetching stops whenever a control transfer or HLT instruc- 
tion is decoded by the lU and placed into the instruction 
queue. 

In real address mode, the prefetcher may fetch up to 5 bytes 
beyond the last control transfer or HLT instruction in a code 
segment. 

In protected mode, the prefetcher will never cause a segment 
overrun exception. The prefetcher stops at the last physical 
memory word of the code segment. Exception 13 will occur if 
the program attempts to execute beyond the last full instruc- 
tion in the code segment. 

If the last byte of a code segment appears on an even physical 
memory address, the prefetcher will read the next physical 
byte of memory (perform a word code fetch). The value of this 
byte is ignored and any attempt to execute it causes exception 
13. 
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Figure 34. Multibus Write Terminated by Asynctironous Ready with Bus Moid 
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Notes: 1. Status lines are not driven by 80286, yet remain liigh due to pull-up resistors in 82C288 and 82289 during 
HOLD state. 

2. Address, M/iO and COD/INTA may start floating during any TC depending on when internal 80288 bus arbiter 
decides to release bus to external HOLD. The float starts in 02 of TC. 



3. BHE and LOCK may start floating after the end of any TC depending on when internal 80286 bus arbiter 
decides to release bus to external HOLD. 

4. The minimum HOLD l to HLDA i time is shown. Max.imum is one Th longer. 

5. The earliest HOLD t time is shown which will always allow a subsequent memory cycle if pending. 

6. The minimum HOLD f to HLDA t time is shown. Max.imum is a function of the instruction, type of bus cycle 
and other machine status (i.e.. Interrupts, Waits, Lock, etc.) 

7. Asynchronous ready allows termination of the cycle. Synchronous ready does not signal ready in this example. 
Synchronous ready state is ignored after ready is signaled via the asynchronous input. 
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Processor Extension Transfers 

The processor extension interface uses I/O port addresses 
00F8(H), OOFA(H), and OOFC(H) which are part of the I/O port 
address range and is a reserved area. An ESC instruction with 
EM = and TS = will perform I/O bus operations to one or 
more of these I/O port addresses independent of the value of 
lOPL and CPL 

ESC instructions with memory references enable the CPU to 
accept PEREQ inputs for processor extension operand trans- 
fers. The CPU will determine the operand starting address and 
read/write status of the instruction. For each operand transfer, 
two or three bus operations, one word transfer with I/O port 
address OOFA(H), and one or two bus operations with memory 
are performed. Three bus operations are required for each 
word operand aligned on an odd byte address. 

Interrupt Acknowledge Sequence 

Figure 35 illustrates an interrupt acknowledge sequence 
performed by the 80286 In response to an INTR input. An 
interrupt acknowledge sequence consists of two INTA bus 
operations. The first allows a master 8259A Programmable 
Interrupt Controller (PIC) to determine which if any of its slaves 
should return the interrupt vector. An eight bit vector Is read by 
the 80286 during the second INTA bus operation to select an 
interrupt handler routine from the interrupt table. 

The Master Cascade Enable (MCE) signal of the 82C288 is 
used to enable the cascade address drivers, during INTA bus 
operations (see Figure 35), onto the local address bus for 
distribution to slave interrupt controllers via the system ad- 
dress bus. The 80286 emits the LOCK signal (active LOW) 
during Tg of the first INTA bus operation. A local bus "hold" 
request will not be honored until the end of the second INTA 
bus operation. 

Three idle processor clocks are provided by the 80286 
between INTA bus operations to allow for the minimum INTA 
to INTA time and CAS (cascade address) out delay of the 
8259A. The second INTA bus operation must always have at 
least one extra Tc state added via logic controlling READY. 
A23 - Ao are in three-state OFF until after the first To state of 
the second INTA bus operation. This prevents bus contention 
between the cascade address drivers and CPU address 



drivers. The extra Tc state allows time for the 80286 to resume 
driving the address lines for subsequent bus operations. 

Local Bus Usage Priorities 

The 80286 local bus is shared among several internal units 
and external HOLD requests. In case of simultaneous re- 
quests, their relative priorities are: 



(Highest) Any transfers which assert LOCK either ex- 
plicitly (via the LOCK instruction prefix) or 
implicitly (i.e., segment descriptor access, in- 
terrupt acknowledge sequence, or an XCHG 
with memory). 

The second of the two byte bus operations 
required for an odd aligned word operand. 

Local bus request via HOLD input. 

Processor extension data operand transfer 
via PEREQ input 

Data transfer performed by EU as part of an 
instruction. 

(Lowest) An instruction prefetch request from BU. The 
EU will inhibit prefetching two processor 
clocks in advance of any data transfers to 
minimize waiting by EU for a prefetch to fin- 
ish. 

Halt or Shutdown Cycles 

The 80286 externally indicates halt or shutdown conditions as 
a bus operation. These conditions occur due to a HLT 
instruction or multiple protection exceptions while attempting 
to execute one instruction. A halt or shu tdown bus operation is 
signalled when SI, SO and COD/InTA are LOW and M/JO is 
HIGH. Ai high indicates halt, and Ai LOW indicates shut- 
down. T he 82C288 bus controller does not issue ALE, nor is 
READY required to terminate a halt or shutdown bus opera- 
tion. 

During halt or shutdown, the 80286 may service PEREQ or 
HOLD requests. A processor extension segment overrun 
exception during shutdown will inhibit further service of PER- 
EQ. Either NMI or RESET will force the 80286 out of either halt 
or shutdown. An INTR, if interrupts are enabled, or a proces- 
sor extension segment overrun exception will also force the 
80286 out of halt 
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Figure 35. Interrupt Acknowledge Sequence 

Notes: 1. Data is ignored. 

2. First INTA cycle should liave at least one wait state inserted to meet 8259A minimum INTA pulse wi dtti. 

3. Secon d INTA cycle must have at least one wait state inserted since the CPU will not drive A23-A0, BHE, and 
LOCK until after the first TC state. 

The CPU imposed one/clock delay prevents bus contention between cascade address buffer being disabled by 
MCE 1 and address outputs. 

Without the wait state, the 80286 address will not be valid for a memory cycle started immediately after the 
second INTA cycle. The 8259A also requires one wait state for minimum INTA pulse width. 

4. LOCK is active for the first INTA cycle to prevent the 82289 from releasing the bus between INTA cycles in a 
multi-master system. 

5. A23-A0 exits three-state OFF during 02 of the second Tc in the INTA cycle. 
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Figure 36. Basic 80286 System Configuration 



System Configurations 

The versatile bus structure of the 80286 microsystem, with a 
full complement of support chips, allows flexible configuration 
of a wide range of systems. The basic configuration, shown in 
Figure 36, is similar to an iAPX 86 maximum mode system. It 
includes the CPU plus an 8259A interrupt controller, 82284 
clock generator, and the 82C288 Bus Controller. The IAPX 86 
latches (29843 and 29845) and transceivers (29833 and 
29863) may be used in an 80286 microsystem. 

As indicated by the dashed lines in Figure 36, the ability to add 
processor extensions is an integral feature of 80286 microsys- 
tems. The processor extension interface allows external 
hardware to perform special functions and transfer data 
concurrent with CPU execution of other instructions. Full 
system integrity is maintained because the 80286 supervises 
all data transfers and instruction execution for the processor 
extension. 

The 80286 with the 80287 numeric processor extension (NPX) 
uses this interface. The iAPX 286/287 has all the instructions 
and data types of an IAPX 86/87 or iAPX 88/87. The 80287 
NPX can perform numeric calculations and data transfers 



concurrently with CPU program execution. Numerics code and 
data have the same integrity as all other information protected 
by the 80286 protection mechanism. 

The 80286 can overlap chip select decoding and address 
propagation during the data transfer for the previous bus 
operation. This information is latched into the 29843/45's by 
ALE during the middle of a Tg cycle. The latched chip select 
and address information remains stable during the bus opera- 
tion while the next cycle's address is being decoded and 
propagated into the system. Decode logic can be imple- 
mented with a high-speed bipolar PROM. 

The optional decode logic shown in Figure 36 takes advan- 
tage of the overlap between address and data of the 80286 
bus cycle to generate advanced memory and l/O-select 
signals. This minimizes system performance degradation 
caused by address propagation and decode delays. In addi- 
tion to selecting memory and I/O, the advanced selects may 
be used with configurations supporting local and system buses 
to enable the appropriate bus interface for each bus cycle. 
The COD/INTA and M/lO signals are applied to the decode 
logic to distinguish between interrupt, I/O, code and data bus 
cycles. 
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Figure 37. Multibus System Bus Interface 



By adding the 82289 bus arbiter chip, the 80286 provides a 
Multibus system bus interface as shown in Figure 37. The ALE 
output of the 82C288 for the Multibus bus is connected to its 
CMDLY input to delay the start of commands one system CLK 
as required to meet Multibus address and write data set-up 
times. This arrangement will add at least one extra Tc state to 



each bus operation which uses the Multibus. 

A second 82C288 bus controller and additional latches and 
transceivers could be added to the local bus of Figure 37. This 
configuration allows the 80286 to support an on-board bus for 
local memory and peripherals and the Multibus for system bus 
interfacing. 
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Figure 38. 80286 Interface with the Am2968 Dynamic Memory Controlier 



Figure 38 shows the interface of the 80286 with the Am2968 
Dynamic Memory Controller. The interface is a timing control- 
ler which consists of some control logic and a delay line. The 
timing controller runs asynchronously to the CPU. It arbitrates 
between memory requests and refresh requests by generating 



the proper signals to the dynamic memory controller and 
memory. The design described is a simple, cost-effective 
solution to interfacing the 80286 with the Am2968. A further 
description about DRAM selection based on processor speed 
may be found in the Am2968 Application Note. 



Tabie 15. 80286 Systems Recommended Pull-up Resistor Values 



80286 Pin and Name 



4 — SI 



53 — ERROR 



54 — BUSY 



63 — READY 



Pull-up Value 



20Kn±10% 



20Kn±10% 



910n±5% 



Purpose 



Pull so, S1, and PEACK inactive during 80286 hold periods. 



Pull ERROR and BUSY inactive v»hen 80287 not present (or temporarily 
removed from socket). 



Pull READY inactive wittiin required minimum time (Cl = 150pF, Ir < 7mA). 



Instruction Set 

The instruction set is divided into seven categories: data 
transfer, arithmetic, shift/rotate/logical, string manipulation, 
control transfer, high level instructions, and processor control. 
These categories are summarized in Figures 3-9. 

An 80286 instruction can reference zero, one, or two operands 
where an operand resides in a register, in the instruction itself, 
or in memory. Zero-operand instructions (e.g., NOP and HLT) 
are usually one byte long. One-operand instructions (e.g., INC 
and DEC) are usually two bytes long, but some are encoded in 



only one byte. One-operand instructions may reference a 
register or memory location. Two-operand instructions permit 
the following six types of instruction operations: 

-Register to Register 
-Memory to Register 
-Immediate to Register 
- Memory to Memory 
-Register to Memory 
-Immediate to Memory 
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Two-operand instructions (e.g. IVIOV and ADD) are usually 
tliree to six bytes long. Memory-to-mennory operations are 



provided by a special class of string instructions requiring one 
to three bytes. 



BVTE 1 BYTE 2 

7«5«a310765432 





1 






opcODt a 


w mod 


'•9 


r/m 










L 























REGISTER OPERAND/REGISTERS TO USE IN OFFSET CALCULATION 

REGISTER OPERAND/EXTENSION OF OPCODE 

REGISTER MODE/MEMORY MODE WrfH DISPLACEMENT LENGTH 

WORD/BYTE OPERATION 

DIRECTION IS TO REGISTER/DIRECTION IS FROM REGISTER 

OPERATION (INSTRUCTION) CODE 



DF003760 



A. SHORT OPCODE FORMAT EXAMPLE 



B^TE 1 BYTE 2 

T65432I076S4jaiO 


7 G 


BYTES 

5 4 3 


2 1 


II MM II il 


1 


1 i 


1 1 


LONG OPCODE 


mod 


r«fl 


r/m 



I 



DF003770 



B. LONG OPCODE FORMAT EXAMPLE 

Figure 39. 80286 Instruction Format Exampies 



80286 INSTRUCTION SET SUMMARY 

Instruction Timing Notes 

The instruction clock counts listed below establish the maxi- 
nnum execution rate of the 80286. With no delays in bus 
cycles, the actual clock count of an 80286 program will 
average 5% more than the calculated clock count, due to 
instruction sequences which execute faster than they can be 
fetched from memory. 

To calculate elapsed times for instruction sequences, multiply 
the sum of all instruction clock counts, as listed in the table 
below, by the processor clock period. An 8 MHz processor 
clock has a clock period of 125 nanoseconds and requires an 
80286 system clock (CLK input) of 16 MHz. 

Instruction Clocl< Count Assumptions 

1. The instruction has been prefetched, decoded, and is ready 
for execution. Control transfer instruction clock counts 
include all time required to fetch, decode, and prepare the 
next instruction for execution. 

2. Bus cycles do not require wait states. 

3. There are no processor extension data transfer or local bus 
HOLD requests. 

4. No exceptions occur during instruction execution. 

Instruction Set Summary Notes 

Addressing displacements selected by the MOD field are not 
shown. If necessary they appear after the instruction fields 
shown. 

Above/below refers to unsigned value 
Greater refers to positive signed value 
Less refers to less positive (more negative) signed values 



if d = 1 then to register; if d = then from register 

if w = 1 then word instruction; if w = then byte instruc- 
tion 

if s = then 1 6-bit immediate data to form the operand 

if s = 1 then an immediate data byte is sign-extended to 
form the 16-bit operand 

X = don't care 

z = used for string primitives for comparison with ZF FLAG 

If two clock counts are given, the smaller refers to a register 
operand and the larger refers to a memory operand. 



* = add one clock if offset calculation requires summing 3 
elements 

n = number of times repeated 

m = number of bytes of code in next instruction 

Level (L) — Lexical nesting level of the procedure 

The following comments describe possible exceptions, side 
effects, and allowed usage for instructions in both operating 
modes of the 80286. 

Real Address Mode Only 

1 . This is a protected mode instruction. Attempted execution in 
real address mode will result in an undefined opcode 
exception (6). 

2. A segment overrun exception (13) will occur if a word 
operand reference at offset FFFF(H) is attempted. 

3. This instruction may be executed in real address mode to 
initialize the GPU for protected mode. 

4. The lOPL and NT fields will remain 0. 

5. Processor extension segment overrun interrupt (9) will 
occur if the operand exceeds the segment limit. 
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Either Mode 

6. An exception may occur, depending on ttie value of ttie 
operand. 



7. LOCK is automatically asserted regardless of the presence 
or absence of tlie LOCK instruction prefix. 

Protected Virtual Address Mode Only 

8. The destination of an INT, JMP, CALL, RET or IRET 
instruction must be in the defined limit of a code segment or 
a general protection exception (13) occurs. 

9. A general protection exception (13) will occur if the memory 
operand cannot be used due to either a segment limit or 
access rights violation. If a stack segment limit is violated, a 
stack segment overrun exception (12) occurs. 

1 0. For segment load operations, the CPL, RPL, and DPL must 
agree with privilege rules to avoid an exception. The 
segment must be present to avoid a not-present exception 
(11). If the SS register is the destination, and a segment 
not-present violation occurs, a stack exception (12) oc- 
curs. 

1 1 . All segment descriptor accesses in the GDT or LPT ma de 
by this instruction will automatically assert LOCK to 
maintain descriptor integrity in multiprocessor systems. 



12. JMP, CALL, INT, RET, IRET instructions referring to 
another code segment will cause a general protection 
exception (13) if any privilege rule is violated. 

13. A general protection exception (13) occurs if CPL^O. 

14. A general protection exception (13) occurs if CPL > lOPL. 

15. The IF field of the flag word is not updated if CPL > lOPL. 
The lOPL field is updated only if CPL = 0. 

16. Any violation of privilege rules as applied to the selector 
operand do not cause a protection exception; rather, the 
instruction does not return a result and the zero flag is 
cleared. 

1 7. If the starting address of the memory operand violates a 
segment limit, or an invalid access is attempted, a general 
protection exception (13) will occur before the ESC instruc- 
tion is executed. A stack segment overrun exception (1 2) 
will occur if the stack limit is violated by the operand's 
starling address. If a segment limit is violated during an 
attempted data transfer then a processor extension seg- 
ment overrun exception (9) occurs. 

18. The destination of an INT, JMP, CALL, RET, or IRET 
instruction must be in the defined limit of a code segment 
or a general protection exception (13) will occur. 
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80286 INSTRUCTION SET SUMMARY 


FUNCTION 


FORMAT 




CLOCK COUNT 


COMMENTS 


Real 

Address 
Mode 


Protected 
Virtual 

Address 
Mode 


Real 

Address 

Mode 


Protected 
Virtual 

Address 
Mode 


DATA TRANSFER 
MOV = Move: 

Register to Register/Memory 
Register/memory to register 
Immediate to register/memory 
Immediate to register 
Memory to accumulator 
Accumulator (o memory 
Register/memory to segment register 
Segment register to register/memory 

PUSH = Push: 

Memory 

Register 

Segment register 
Immediate 

PUSHA - Pusli Ail 






2.3' 
2,5' 
2.3' 

2 

5 

3 
2,5' 
2,3' 

€ 
3 
3 


2,3' 
2,5" 
2,3' 

2 

5 

3 
17,19' 
2,3' 

s' 

3 
3 


2 
2 
2 

2 
2 
2 
2 

2 
2 
2 


9 

9 

9 

9 

9 

9,10,11 

9 

9 

9 
9 


1 1 w 


mod reg r/m 






1 1 1 w 


mod reg r/m 






1 1 1 t w 


mod r/m data data if w = 1 






1 1 1 w reg 


data data if w = 1 






1 f w 


addr-low 1 addr-high | 






1 1 1 w 


addr-low | addr-higii | 






f 1 1 1 


mod reg r/m 






10 110 


mod reg r/m 






11111111 


mod 1 1 r/m 






10 10 reg 




reg 1 1 




1 1 1 s 


data data if s = 


3 
17 


3 

17 


2 

2 


9 
9 






110 


POP = Pop: 

Memory 

Register 

Segment register 






s' 

5 

5 


6' 

5 
20 

19 


2 
2 
2 

2 


9 
9 

9,10,11 

9 


10 1111 


mod r/m 




(reg* 01) 


10 11 reg 




reg 1 1 1 




POPA = Pop All 


110 1 




19 


XCHG = Exchange: 

Register/memory with register 

Register with accumulator 

IN = Input from: 

Fixed port 

Variable port 

OUT = Output to: 

Fixed port 

Variable port 

XU^T - Translate byte to AL 
LEA = Load EA to register 
LDS = Load pointer to DS 
LES - Load pointer to ES 
LAHF - Load AH with (lags 
SAHF - Store AH into flags 
PUSHF - Push flags 
POPF - Pop flags 






3.5' 
3 

5 
5 

3 
3 
5 
3' 
7* 
7' 
2 
2 
3 
5 


3,5" 
3 

5 
5 

3 

3 

5 

3' 
21' 
21' 

2 

2 

3 

5 


2,7 

2 
2 

2 
2,4 


7,9 

14 
14 

14 
14 
9 

9,10,11 
9,10,11 

9 
9,15 


10 1 1 w 


mod reg r/m 






10 10 reg 




1 1 1 1 w 


port 1 






1 1 1 1 1 w 




1 1 1 1 1 w 


port 1 






1 1 1 1 1 1 w 




110 10 111 




10 110 1 


mod reg r/m 






110 10 1 


mod reg r/m (moduli) 






110 10 


mod reg r/m | {mod=;tii) 






10 11111 




10 11110 




10 1110 




10 1110 1 




Shaded areas Indicate instri 


ctions not ava 


liable in iAPX 86, 88 microsystems. 











All mnemonics copyright Intel Corp., 1983. 
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80286 INSTRUCTION SET SUMMARY (Continued) 


FUNCTION 


FORMAT 


CLOCK COUNT 


COMMENTS 


Real 

Address 

Mode 


Protected 
Virtual 

Address 
Mode 


Real 

Address 

Mode 


Protected 
Virtual 

Address 
Mode 


ARITHMETIC 
ADD = Add: 

Reg/memory with register to eittier 

Immediate to register / memory 

Immediate to accumulator 
ADC = Add with carry: 

Reg/memoiy with register to either 

Immediate to register/memory 

Immediate to accumulator 

INC = Increment: 

Register/memory 

Register 

SUB = Subtract: 

Reg/memory and register to either 

Immediate from register/memory 
Immediate from accumulator 
SBB = Subtract with borrow: 
Reg/memory and register to either 
immediate from register/memory 
immediate from accumulator 
DEC = Decrement: 
Register/memory 
Register 

CMP - Compare: 
Register/memory with register 
Register with register/memory 
Immediate with register/memory 
Immediate with accumulator 
NEG = Change sign 
AAA - ASCII adiust for add 
DAA = Decimal adjust for add 
AAS - ASCII adjust for subtract 
DAS = Decimal adjust for subtract 

MUL - Mulitlply (unsigned) 

Register-Byte 
Register-Word 
Memory-Byte 

Memory-Word 

IMUL = Integer multiply (signed): 

Registor-Byte 
Register-Word 
Memory-Byte 
Memory-Word 




2.7' 

3,7' 

3 

2.7' 

3,7' 

3 

2,7- 
2 

2,7" 

3,7' 

3 

2.7' 

3,7" 

3 

2.7' 
2 

2,6' 
2,7' 
3,6' 

3 

2 

3 

3 

3 

3 

13 
21 
16' 

24" 

13 
21 

16" 

24" 


2,7" 
3,7" 
3 

2,7" 

3,7" 

3 

2,7" 
2 

2,7" 

3,7" 

3 

2.7" 

3.7" 
3 

2,7" 
2 

2,6" 
2,7" 
3,6" 

3 

7* 

3 

3 

3 

3 

13 
21 
16' 
24" 

13 
21 
16" 
24" 


2 
2 

2 
2 

2 

2 
2 

2 
2 

2 

2 
2 
2 

2 

2 
2 

2 
2 


9 
9 

9 
9 

9 

9 

9 

9 
9 

9 

9 
9 
9 

7 

9 
9 

9 
9 


OOOOOOdw mod reg r/m 




1 s w 1 mod r/m | data | data if s:w = 01 | 




1 w 1 data | data if w - 1 | 




1 d w mod reg r/m 




1 s w 1 mod 1 r/m | data | data if s:w = 01 | 




1 1 w 1 data | data if w - 1 | 




1 1 1 1 1 1 1 w 1 mod r/m | 




10 reg | 




1 1 d w 1 mod reg r/m | 




1 s w 1 mod 1 1 r/m | data | data if s:w = 01 | 




10 1 1 w 1 data | data if w = 1 | 




1 1 d w mod reg r/m 




1 s w 1 mod 1 1 r/m | data | data if s:w = 01 | 




1 1 1 w 1 data | data it w = 1 | 




1 1 1 1 1 1 1 w mod 1 r/m 




10 1 reg 1 




1 1 1 1 w mod reg r/m 




1 1 1 w mod reg r/m 




1 s w 1 mod 1 1 1 r/m | data | data if s:w = 01 | 




11 1 1 w 1 data 1 data if w = 1 ] 




1 1 1 1 1 1 w mod 1 1 r/m 




1 1 1 1 1 1 




1 1 1 1 1 




111111 




10 1111 




1 1 1 1 1 1 w 1 mod 1 r/m | 




1 1 1 1 1 1 w [ mod 1 1 r/m 




Shaded areas indicate instri. 


ctions not available in lAPX 86, 88 microsystems. 









All mnemonics copyright Intel Corp., 1983. 
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80286 INSTRUCTION SET SUMMARY (Continued) 


FUNCTION 


FORMAT 


CLOCK 


COUNT 


COMMENTS 


Real 

Address 

Mode 


Protected 
Virtual 

Address 
Mode 


Real 

Address 

Mode 


Protected 
Virtual 

Address 
Mode 


ARITHMETIC (Continued) 






2 


9 


IMUL = Integer immediate multiply 

(signed) 

DIV = Divide (unsigned): 

Register-Byte 
Register-Word 

Memory-Byte 
Memory-Word 

IDIV = Integer divide (signed): 

Register-Byte 
Register-Word 
Memory-Byte 
Memory-Word 

AAM - ASCII adjust (or multiply 

AAD - ASCII adjust lor divide 

CBW = Convert byte to word 

CWD = Convert word to double word 

LOGIC 

Shift/Rotate Instructions: 

Register/Memory by 1 

Register/Memory by CL 


1 1 1 s 1 mod reg r/m data data if s = 


21,24 

14 

22 
17' 
25' 

17 

25 
20' 
28' 

16 
14 
2 

2 

2,7' 
5 + n.8 + n 

5 + n,8-^n' 


21.24 

14 
22 

17' 
25" 

17 

25 
20' 
26' 

16 
14 

2 

2 

2,7" 
5 + n,8 + n 




2,6 
2,6 

2 
2 

2 
2 


-8.9 
6.9 

9 
9 

9 

9 


1 1 1 1 1 1 1 w 1 mod 1 1 r/m | 




1 1 1 1 1 1 1 w 1 mod 1 1 1 r/m | 




|iioioioo|ooooioio| 




|iioioioi|ooooioio| 




1 1 1 1 1 




1 1 1 1 1 1 




1 1 1 1 w 1 mod TTT r/m | 




1 1 1 1 1 w 1 mod TTT r/m | 




Register/Memory by Count 


1 1 w mod TTT r/m count 


5 + n.B + n' 


2 


9 


AND = And: 

Reg/memory and register to either 
Immediate to register/memory 
Immediate to accumulator 
TEST = And function to flags, no rest 
Register/memory and register 
Immediate data and register/memory 
Immediate data and accumulator 
OR = On 

Reg/memory and register to either 
Immediate to register/memory 
Immediate to accumulator 
XOR = Exclusive or: 
Reg/memory and register to either 
Immediate to register/memory 
Immediate to accumulator 
NOT = Invert register/memory 


TTT Instruction 
ROL 
1 ROR 
10 RCL 

1 1 RCR 

1 SHL/SAL 
1 1 SHR 
111 SAR 


2.7' 

3.7' 

3 

2,6' 

3.6' 

3 

2,7" 

3,7' 

3 

2,7' 
3,7' 

3 
2,7" 


2.7' 

3,7" 

3 

2,6" 

3,6" 

3 

2,7" 
3,7" 

3 

2,7" 
3,7" 

3 
2,7" 


2 
2 

2 
2 

2 
2 

2 
2 

2 


9 
9 

9 
9 

9 
9 

9 
9 

9 


1 d w mod reg r/m 




j 1 w 1 mod 1 r/m | data | data if w = 1 | 




1 1 w data data if wr = 1 


It: 


1 1 1 v^ I mod reg r/m | 




j 1 1 1 1 1 1 w 1 mod r/m | data | data if w = 1 | 




1 1 1 1 v» 1 data | data if w - 1 | 




1 d w mod reg r/m 




1 1 w 1 mod 1 r/m | data | data if w = 1 ] 




1 1 w data data if w = 1 




1 1 d w mod reg r/m 




1 1 v« 1 mod 1 1 r/m | data | data if w - 1 | 




1 1 1 w data data if w-= 1 




1 1 1 1 1 1 w mod 1 r/m 




Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 
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80286 INSTRUCTION SET SUMMARY (Continued) 



FUNCTION 



FORMAT 



STRING MANIPULATION: 

MOVS = Move byto/word 

CMPS = Compare byte/word 

SCAS = Scan byte/word 

LODS = Load byte/wd to AL/AX 

STOS - Stor byte/wd Irom AL/A 

INS = Input byte/wd from DX port 

OUTS = Output byte/wd to DX port 

Repeated by count in CX 
MOVS = Move string 

CMPS = Compare string 

SCAS = Scan string 

LODS = Load string 

STOS = Store string 

INS = Input siring 

OUTS = Output string 
CONTROL TRANSFER 
CALL = Call: 

Direct wittiin segment 

Register memory 
indirect within segment 

Direct intersegment 



Protected Mode Only (Direct intersegment): 

Via call gate to same privilege level 

Via call gate to different privilege level, no parameters 

Via call gate to different privilege level, x parameters 

Via TSS 
Via task gate 



1 1 1 w 




1 1 1 1 w 




1 1 1 1 1 wj 




M 1 1 1 w 




1 1 1 1 1 w 1 




1 1 1 1 1 w 1 




1 1 1 1 1 w 




|l1110010|l010010w| 




|ll11001z|l010011w| 




|l111001z|l010111w[ 




|iiiiooio|ioioiiOw| 




|iiiiooio|ioioioiw| 




|iiiiooio|oiioiiow| 




|iiiiooio|oiioiiiw| 




1 1 1 1 1 1 disp-low 1 disp-high | 




1 1 1 1 1 1 1 1 1 1 mod 1 r/m 1 




1 1 1 1 1 [ segment offset | 




1 segment selector [ 



11111111 



Indirect intersegment 

Protected Mode Only (Indirect Intersegment): 

Via call gate to same privilege level 

Via call gate to different privilege level, no parameters 

Via call gate to different privilege level, x parameters 

Via TSS 

Via task gate 

JMP = Unconditional Jump: 

Short/long 

Direct within segment 
Register/memory indirect within segment 
Direct intersegment 



Protected Mode Only (Direct Intersegment): 

Via call gate to same privilege level 

Via TSS 

Via task gate 



mod 1 1 r/m 



1 1 1 1 1 1 1 1 disp-low 1 




1 1 1 1 1 1 1 disp-low 1 disp-high | 




I 1 1 1 1 1 1 1 1 1 mod 1 r/m | 




1 1 1 1 1 1 1 segment offset | 




segment selector 



indirect intersegment 



11111111 mod 1 1 r/m 



Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 



CLOCK COUNT 



Real 

Address 

Mode 



5 -(-9n 
5-H8n 
5 + 4n 

4 + 3n 

5 + 4n 
5 + 4n 



7 + m.11 +m 
13-t-m 



Protected 
Virtual 

Address 
Mode 



COMMENTS 



7 
5 
3 
5 

5 

5-H4n 
5 + 9n 
5 + 8n 

5-H4n 

4 + 3n 

5 + 4n 
5 + 4n 

7 + m 
7 + m,11 +m 



41 -Hm 
82-1- m 
86 + 4x + ft 
177 + m 
182 -t-m 

29 -f- m* 

44 + m* 
83 + m* 

90 + 4x + n 



Real 

Address 

Mode 



7 + m 


7 + m 


7 + m 


7 + m 


+ m,l 1 + m 


7 + m,11 + 


11 +m 


23 + m 



38 + m 

175 + m 
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80286 INSTRUCTION SET SUMMARY (Continued) 



FUNCTION 



FORMAT 



CLOCK COUNT 



Real 

Address 

Mode 



Protected 
Virtual 

Address 
Mode 



COMMENTS 



Real 

Address 
Mode 



Protected 
Virtual 

Address 
Mode 



CONTROL TRANSFER (Continued): 

Protected Mode Only (Indirect Intersegment): 

Via call gate to same privilege level 
Via TSS 
Via task gate 

RET = Return from CALL: 



110 11 



Wittiin segment 

Within seg adding immed to SP 110 10 

Intersegment 110 10 11, 

Intersegment adding immediate to SP 110 1 1 I 

Protected Mode Only (RET): 
To different privilege level 



JE/JZ <= Jump on equal zero 

JL/JNGE = Jump on less not greater or 
equal 

JLE/JNG = Jump on less or equal not 
greater 

JB/JNAE = Jump on below not above or 
equal 

JBE/JNA = Jump on below or equal nol 
above 

JP/JPE = Jump on parity/parity even 

JO = Jump on overflow 

JS " Jump on sign 

JNE/JNZ = Jump on not equal not zero 

JNL/JGE = Jump on nol less greater or 
equal 

JNLE/JG = Jump on not less or equal 
greater 

JNB/JAE = Jump on not below above or 
equal 

JNBE/JA =" Jump on not below or equal 
above 

JNP/ JPO = Jump on not par / par odd 

JNO = Jump on not overflow 

JNS = Jump on nol sign 

LOOP = Loop CX limes 

LOOPZ/LOOPE = Loop while zero equal 

LOOPNZ/LOOPNE = Loop while not zero 
equal 

JCXZ = Jump on CX zero 

ENTER = Enter Procedure 

L-0 
L-1 
L>1 

LEAVE = Leave Procedure 



1110 10 



111110 



1111110 



1110 10 



1110 110 



11110 10 



1 110 



11110 



1110 10 1 



111110 1 



1111111 



1110 11 



1110 111 



11110 11 



1110 1 



11110 1 



110 10 



1 10 1 



1 10 



110 11 



1 10 



I 1 1 1 1 



data-low 



dlsp 



disp 



disp 



disp 



disp 



disp 



data-tiigh 



data-high 



data-high 



Shaded areas indicate instructions not available In iAPX 86, 88 microsystems. 



IH-m 
11 +m 
15-I- m 
15 + m 

7 + m or 3 
7 + m or 3 



7 + m or 3 

7 + m or 3 
7 + m or 3 
7 -K m or 3 
7 -f m or 3 

7 + m or 3 



7 + m or 3 

7 + m or 3 

7 + m or 3 

7 -H m or 3 
6 -H m or 4 
-fr m or 4 

8 + m or 4 



16-4(L-1) 
5 



41 -Hm 

178 -I- m] 
183 + m* 



55-^m 
7 -H m or 3 
7 -(- m or 3 

7 -t- m or 3 



7 -H m or 3 

7 + m or 3 

7 ■^ m or 3 

7 -(■ m or 3 

7 + m or 3 

7 + m or 3 



7 + m or 3 

7 + m or 3 

7 + m or 3 

7 + m or 3 

8 -t- m or 4 
8 + m or 4 

8 + m or 4 



15 
I6-4(L-1) 



8,9,11,12 

8,9.11.12 
8.9,11,12 



8,9,11.12 
8,9,11,12 
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80286 INSTRUCTION SET SUMMARY (Continued) 



FUNCTION 



FORMAT 



CLOCK COUNT 



Real 

Address 

Mode 



Protected 
Virtual 

Address 
Mode 



COMMENTS 



Real 

Address 

Mode 



Protected 
Virtual 

Address 
Mode 



CONTROL TRANSFER (Conllnued): 
INT = Interrupt: 

Type specified 

Type 3 

INTO = Interrupt on overflow 



110 110 1 



110 110 



110 1110 



Protected Mode Only: 

Via interrupt or trap gate to same privilege level 
Via interrupt or trap gate to (it dilferent privilege level 
Via Task Gate 

IRET = Interrupt return 

Protected Mode Only: 

To different privilege level 
To difterenl tasis {NT=1) 



110 1111 



BOUND = Delect value out of range 110 10 mod reg r/m 



PROCESSOR CONTROL 

CLC = Clear carry 

CMC = Complement carry 

STC = Set carry 

CLD = Clear direction 

STD = Set direction 

CLI = Clear interrupt 

STI = Set interrupt 

HLT - Halt 

WAIT - Wait 

LOCK = Bus lock prefix 

GTS = Clear task switched flag 

ESC = Processor Extension Escape 



111110 




1 1 1 1 1 1 1 1 




1 1 1 1 1 1 1 1 




1 1 1 1 1 1 1 1 




1111110 1 




1 1 1 1 1 1 1 1 




111110 11 




1 1 1 1 1 1 1 




10 110 11 




1 1 1 1 1 1 




|ooooiiii|oooooiio| 




1 1 1 1 T T T 1 mod LLL t/m | 



(TTT LLL are opcode to processor extension) 



23 + m 
23 + m 



(3 if no) 
(Interrupt) 



(3 if no) 
(Interrupt) 



167 + in 
31 + m 



55 + m 
169 + m 



(Use INT 

clock 

count if 

exception 

6) 





2 

9-20' 



6,11,12 
6,11.12 
8.11.12 

),9,11,12.1^ 



8.9.11.12.15 
6.9.11,12 



Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 



All mnemonics copyrigfit Intel Corp., 1983. 



80286 INSTRUCTION SET SUMMARY (Continued) 



FUNCTION 



FORMAT 



CLOCK COUNT 



Real 

Address 

Mode 



Protected 
Virtual 

Address 
Mode 



COMMENTS 



Address 
Mode 



Protected 
Virtual 

Address 
Mode 



PROTECTION CONTROL 

LGDT = Load global descriptor labfe register 

SGDT = Store global descriptor table register 

LIDT = load interrupt descriptor table register 

SIDT = Store interrupt descriptor table register 

LLDT = Load local descriptor table register 
from register memory 

SLOT = Store local descriptor table register to 

register/ memory 

LTR = Load task register from register/memory 

STR =• Store task register to register memory 

LMSW = Load machine status word from 
register/memory 

SMSW •= Store machine status word 

LAR = Load access rights from register/ 
memory 

LSL = Load segment limit from register/ 
memory 

ARPL = Adjust requested privilege level: from rogisior/ memory 

VERR = Verify read access: register/memory 1 

VERR = Verify m\e access: 



1111 


1 


mod 1 r/m 








1111 


1 


mod f/m 








1111 


1 


mod 1 1 r/m 








1111 


1 


mod 1 r/m 








1111 


oooooooo 


mod 1 r/m 








1111 


oooooooo 


mod r/m 








1 1 1 1 


oooooooo 


mod 1 1 r/m 






1 11 1 


oooooooo 


mod 1 r/m 








1 1 1 1 


1 


mod 1 1 r/m 








1111 


1 


mod 1 r/m 








1111 


10 


mod reg r/m 








1111 


1 1 


mod reg r/m 








gisior/ memory 


110 11 


mod reg r/m 






1111 


1 mod 1 r/m 






1111 


OOOOOOOOJ mod 1 1 r/m 



2,3 
2,3 



2,3 
2,3 



14,16 

lo'.il' 
14,16' 
14.16" 



9,11,13 
9,11,13 



9,16 
9,16 



Shaded areas indicate instructions not available in iAPX 86, 88 microsystems. 



Footnotes 

The effective Address (EA) of the memory operand is 
computed according to the mod and r/m fields: 

if mod = 1 1 then r/m is treated as a REG field 

if mod = 00 then DISP = 0*, disp-low and disp-high are 

absent 

if mod = 01 then DISP = disp-low sign-extended to 16-bits, 

disp-high is absent 

if mod = 10 then DISP = disp-high: disp-low 

if r/m = 000 then EA = 
if r/m = 001 then EA = 
if r/m = 010 then EA = 
if r/m = 011 then EA = 
if r/m = 100 then EA = 
if r/m = 101 then EA = 
if r/m = 110 then EA = 
if r/m = 111 then EA = 

DISP follows 2nd byte of instruction (before data if 

required) 

•except if mod = 00 and r/m = 110 then EA = disp-high: disp-low. 

SEGMENT OVERRIDE PREFIX 



REG is assigned according to the following table: 



(BX) + (SI) + DISP 
(BX) + (Dl) + DISP 
(BP) + (SI) + DISP 
(BP) + (Dl) + DISP 
(SI) + DISP 
(Dl) -t- DISP 
(BP) + DISP* 
(BX) + DISP 



16-Blt 


(w=1) 


8-Blt 


(w = 0) 


000 


AX 


000 


AL 


001 


CX 


001 


CL 


010 


DX 


010 


DL 


oil 


BX 


011 


BL 


100 


SP 


100 


AH 


101 


BP 


101 


CH 


110 


SI 


110 


DH 


111 


Dl 


111 


BH 



The physical addresses of all operands addressed by the 
BP register are computed using the SS segment register. 
The physical addresses of the destination operands of the 
string primitive operations (those addressed by the Dl 
register) are computed using the ES segment, which may 
not be overridden. 



1 reg 1 1 1 



REG is assigned according to the following: 

Segment 
REG Register 

00 ES 

01 CS 

10 SS 

11 DS 



All mnemonics copyright Intel Corp., 1983. 



ABSOLUTE MAXIMUM RATINGS 

Storage Temperature -65 to +150°C 

Voltage on Any Pin with 

Respect to Ground -1.0 to +7.0 V 

Power Dissipation 3.3 Watts 

Stresses above those listed under ABSOLUTE MAXIMUM 
RATINGS may cause permanent device failure. Functionality 
at or above these limits is not implied. Exposure to absolute 
maximum ratings for extended periods may affect device 
reliability. 



OPERATING RANGES 



Part Number 


Temperature 
Range 


Vcc 


80286-6 


Ta = to 55°C 
TCASE = to 85°C 


5.0 V ±5% 


80286-8 


80286-10 



Operating ranges define those limits over which the function- 
ality of the device is guaranteed. 



DC CHARACTERISTICS (Ta = o to 55°c, Tcase = o to 85°C; Vcc = 5 v ±5%) 



Parameters 



V|L 



VlH 



ViLC 



V|HC 



Vol 



VOH 



Ilo 



Ice 



CCLK 



C|N 



Co 



Ilo 



l|L 



Description 



Input LOW Voltage 



Input HIGH Voltage 



CLK Input LOW Voltage 



CLK Input HIGH Voltage 



Output LOW Voltage 



Output HIGH Voltage 



Input Leakage Current 



Output Leakage Current 



Supply Current (turn on, 0°C) 



CLK Input Capacitance 



Ottier Input Capacitance 



Input/Output Capacitance 



Output Leakage Current 



Input Susta ining Cu rrent on 
BUSY and ERROR pins 



Test Conditions 



lOL = 2.0 mA 



lOH = -400 mA 



V<V|N<Vcc 



.45 V<VouT<Vcc 



Note 1 



Fc = 1 MHz 



Fc = 1 MHz 



Fc = 1 MHz 



V < Vout < ■O'fS V 



Vin = V 



6 and 8 IVIHz 



Min. 



Max. 



Vcc + .5 



Vcc + .5 



.45 



600 



10 IVIHz 



Min. 



2.0 



3.8 



Max. 



.8 



Vcc + .5 



Vcc + .5 



.45 



Notes: 1. Low temperature Is worst case. 



Units 



mA 



ma 

mA 



pF 
pF 
mA 



mA 



45 



SWITCHING CHARACTERISTICS (Ta = o to 55°c. Tcase = o to 85°C) 

AC timings are referenced to 0.8 V and 2.0 V points of signals as illustrated in datasheet waveforms, unless otherarise 

noted. 


Parameters 


Description 


Test Conditions 


6MHz 


8UHZ 


10MHz 


Units 


lUlin. 


lUax. 


Min. 


Max. 


Min. 


Max. 


1 


System Clock (CLK) Period 




83 


250 


62 


250 


50 


250 


ns 


2 


System Clock (CLK) LOW Time 


at 1.0 V 


20 


225 


15 


225 


11 


232 


ns 


3 


System Clock (CLK) HIGH Time 


at 3.6 V 


25 


230 


25 


235 


18 


239 


ns 


17 


System Clock (CLK) Rise Time 


1.0 V to 3.6 V 




10 




10 




8 


ns 


18 


System Clock (CLK) Fall Time 


3.6 V to 1.0 V 




10 




10 




8 


ns 


4 


Asynch. Inputs Set-up Time 


Note 1 


30 




20 




20 




ns 


5 


Asynch. Inputs Hold Time 


Note 1 


30 




20 




20 




ns 


6 


RESET Set-up Time 




33 




28 




23 




ns 


7 


RESET Hold Time 




5 




5 




5 




ns 


e 


Read Data Set-up Time 




20 




10 




8 




ns 


9 


Read Data Hold Time 




8 




8 




8 




ns 


10 


READY Set-up Time 




50 




38 




26 




ns 


11 


READY Hold Time 




35 




25 




25 




ns 


12 


Status/PEACK Valid Delay 


Note 2, Note 3 


1 


56 


1 


40 


- 




ns 


12a 


Status/PEACK Active Delay 


Note 2, Note 3 








- 


1 


28 


ns 


12b 


Status/PEACK Inactive Delay 


Note 2, Note 3 








- 


1 


30 


ns 


13 


Address Valid Delay 


Note 2, Note 3 


1 


80 


1 


60 


1 


47 


ns 


14 


Write Data Valid Delay 


Note 2, Note 3 





65 





50 





40 


ns 


15 


Address/Status/Data Float Delay 


Note 2, Note 4 





80 





50 





47 


ns 


16 


HLDA Valid Delay 


Note 2, Note 3 





80 





50 





47 


ns 


19 


Address Valid To Status 
Valid Setup Time 


Note 3, Note 5, 
Note 6 


- 




38 




27 




ns 


Notes: 1. Async 
assure 

2. Delay 

3. Outpu 

4. Float 

5. Delay 
reach 


hronous inputs are INTR, NMI, HOLD PEREQ, ERROR, and BUSY 
) recognition at a specific CLK edge. 

from 0.8 V on the CLK lo 0.8 V or 2.0 V or float on the output 
t load: Cl= 100 pF. 
condition occurs when output current is less than Ilq in magnitude 

measured from address either reaching 0.8 V or 2.0 V (valid) to s 
ng 0.8 V. 


. This specification is given only for testing purposes to 

as appropriate for valid or floating condition. 

s. 

tatus going active reaching 2.0 V or status going inactive 


6. For lo 

82284 Titnin 


ad capacitance of 10 pF on STATUS/PEACK lines, subtract typica 

g Requirements 


lly 7 ns for 8 MHz spec, and maximum 7 ns for 10 MHz. 


Parameters 


Description 


Test Conditions 


82284-6 


82284-8 


82284-10 


Units 


Min. 


Max. 


Min. 


Max. 


Min. 


Max. 


11 


SRDY/SRDYEN Set-up Time 




25 




17 




15 




ns 


12 


SRDY/SRDYEN Hold Time 



















ns 


13 


ARDY/ARDYEN Set-up Time 


Note 1 


5 














ns 


14 


ARDY/ARDYEN Hold Time 


Note 1 


30 




30 




30 




ns 


19 


PCLK Delay 


CL = 75pF 
lOL ~ 5 mA 
lOH = - 1 "lA 





45 





45 





35 


ns 


Note 1. These times are given for testing purposes to assure a predetermined action. 
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82C288 Timing Requirements 


Parameters 


Description 


Test Conditions 


82C288-6 


82C288-8 


82C288-10 


Units 


IVIin. 


IVIax. 


Min. 


lUlax. 


lUlin. 


Max. 


12 


CMDLY Set-up Time 




25 




20 




15 




ns 


13 


CMDLT Hold Time 




1 




1 




1 




ns 


30 
29 


Command Delay 
from CLK 


Command Inactive 


Gl = 300 pF Max. 
lOL = 32 mA Max. 
lOH = 5 mA Max. 


3 


30 


3 


25 


3 


20 


ns 


Command Active 


3 


40 


3 


25 


3 


21 


16 


ALE Active Delay 


Cl= 150 pF 

lOL = "IS mA Max. 

'oh = - 1 mA Max. 


3 


25 


3 


20 


3 


16 


ns 


17 


ALE Inactive Delay 




35 




25 




19 


ns 


19 


DT/R Read Active Delay 




40 





25 





23 


ns 


22 


DT/R Read Inactive Delay 


6 


45 


5 


35 


5 


20 


ns 


20 


DEN Read Active Delay 


5 


50 


5 


35 


5 


21 


ns 


21 


DEN Read Inactive Delay 


3 


40 


3 


35 


3 


21 


ns 


23 


DEN Write Active Delay 




35 




30 




23 


ns 


24 


DEN Write Inactive Delay 


3 


35 


3 


30 


3 


19 


ns 
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SWITCHING WAVEFORMS 
MAJOR CYCLE TIMING 



BUS CVCLE TYPE 



^.c^AwnEiiiiim 



'• //mm/Ill i/m/iTi^ . 



015-00 -- — — — — __« ___ 



RPZG7 



\m\\\m\ \\\ \\\\\\\\\\\m\\\\\MM^ 



VALID ADDRESS 



VAUO CONTROL 



< 






® 



rS* 



VAUOfKAO 



fe-iAf~ 



i® 



®i* 



5RISv-»4ft6VEh s 



\m\\\vm\\m\\\\\\4^^^^^^ 



ARDV»XHBVEM 



vvwmmmmww ^?^ 



J \ r 



® 



— -® 



^, 



/ 



®-^ -►© 



' \mm\m\\\\\\\\\\\m\\ 



® 



® 



y- ^j^ 



M//// ///////mmm 



@ 



® 



@ 



J 



— |®k— 



® 



©--* 



VALID COtfTROL 



WUDWMTCDAYA 



rfi 



® 






7" 



® 



y 






^s. 



© 




®K- 






J^mMTZMM 






mmmmzm 



@ 






® 



Note: 1. MWTC is valid at this point only if CMDLY is LOW. 
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SWITCHING WAVEFORMS (Continued) 



80286 ASYNCHRONOUS INPUT 
SIGNAL TIMING 



80286 RESET INPUT TIMING AND 
SUBSEQUENT PROCESSOR CYCLE PHASE 



BUS CYCIX TYPE 




WF009930 

Notes: 

1. PCLK indicates which processor cycle 
phase will occur on the next CLK. PCLK 
may not indicate the correct phase until 
the first bus cycle is performed. 

2. These inputs are asynchronous. The set- 
up and hold times shown assure recogni- 
tion for testing purposes. 




WF007930 

Note 1: When RESET meets the set-up time 
shown, the next CLK will start or re- 
peat 01 of a processor cycle. 



EXITING AND ENTERING HOLD 



BUS CrOE TYPE 




BHE,LaCK — - 

*..-/»!> (SEEH0TC6.) 

M/IO. " 
COO/MTA 



D„ - Do . 



H ® 

(SEE NOTE e.) 



(SEE NOTE 2.) 
® 






I 



J \ / V—^s/ \ / \ r 



Notes: 1. These signals may not be driven by the 80286 during the time shown. The worst case in terms of latest float 
time is shown. 

2. The data bus will be driven as shown if the last cycle before T| in the diagram was a write Tq. 

3. The 80286 floats its status pins during Th. External 20 kfi resistors keep these signals high (see Table 15). 

4. For HOLD reque st set-up to HLDA, refer to Figure 34. 

5. BHE and LOCK are driven at this time but will not become valid until Ts. 

6. The data bus will remain in three-state OFF if a read cycle is performed. 
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SWITCHING WAVEFORMS (Continued) 



80286 PEREQ/PEACK TIMING REQUIRED PEREQ TIMING FOR ONE TRANSFER. ONLY 



BUS CYCLE TVPC 




COOrfHTA ^ 



_ I/O READ IF PROC. EXT TO MEUOftV 
MEMORY READ IF MEMORY TO PROC. EXT. 



MEMORY WRTTE IF PROC, EXT TO MEMORY 
I/O WRITE IF MEMORY TO PROC. EXT. 



~^_ (SEENOTEl.) 






MEMORY AOORESS IF PROC. EXT TO MEMORY TRANSFER 

I/O PORT AOORESS OOFAfH) IF MEMORY TO PROC. EXT. TRANSFER 



xzx 



©k- 

J2Z 



WF007953 

ASSUMING WORD-ALIGNED MEMORY OPERAND; IF ODD ALIGNED, 80286 TRANSFERS TO/FROM 
MEMORY BYTE-AT-A-TIME WITH TWO MEMORY CYCLES. 



Notes: 1. PEACK always goes active during the first bus operation of a processor extension data operand transfer se- 
quence. The first bus operation will be either a memory read at operand address or I/O read at port address 
OOFA(H). 

2. To prevent a second processor extension data operand transfer, the worst case maximum time (shown above) 
is: 3 X © - ©max - ®min- The actual, configuration dependent, maximum time is: 3 x©-(n)max-®min + Ax2x©. 
A is the number of extra Tc states added to either the first or second bus operation of the processor extension 
data operand transfer sequence. 



INITIAL 80286 PIN STATE DURING RESET 




mmmm\mm m?mmmmm))m)m) — 



«<5>» 



IF HOLO n ItSU WltVE (SEE NOTE 4) 



-5$- 



Notes: 1. Set-up time for RESET t may be violated with the consideration that 01 of the processor clock may begin one 
system CLK period later. 

2. Set-up and hold times for RESET i must be met for proper operation, but RESET j may occur during 01 or 02. 

3. The data bus is only guaranteed to be in three-state OFF at the time shown. 

4. HOLD is acknowledged during RESET, causing HLDA to go active and the appropriate pins to float. If HOLD 
remains active while RESET goes inactive, the 80286 remains in HOLD state and will not perform any bus 
accesses until HOLD is deactivated. 
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PHYSICAL DIMENSIONS 

CA2068 

(Option 2) 



.065 
.120" 



Important: 

Option 1 - Electrical connection tenninals exist 

in t>ott) planes 1 and 2. 
Option 2 - Electrical connection terminals exist 

in plane 2 (top) only. 




.050 
".070 



PID # 07287A 
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The Intemational Standard of 
Quality guarantees a 0.05% AQL on all 
electrical parameters, AC and DC, 
over the entire oneratln^^Bn^e. 




NOTES 



NOTES 



NOTES 



ADVANCED MICRO DEVICES 
DOMESTIC SALES OFFICES 



ALABAMA (205) 882-9122 

ARIZONA, 

Tempe (602) 242-4400 

Tucson (602) 792-1200 

CALIFORNIA, 

El Segundo (213) 640-3210 

Newport Beach (714) 752-6262 

San Diego (619) 560-7030 

Sunnyvale (408) 720-8811 

Woodland Hills (818) 992-4155 

COLORADO (303) 691-5100 

CONNECTICUT, 

Southbury (203) 264-7800 

FLORIDA, 

Altamonte Springs (305) 339-5022 

Clearwater (813) 530-9971 

Ft. Lauderdale (305) 484-8600 

Melbourne (305) 254-2915 

GEORGIA (404) 449-7920 

ILLINOIS (312) 773-4422 

INDIANA (317) 244-7207 

KANSAS (913) 451-3115 

MARYLAND (301) 796-9310 



MASSACHUSETTS (617) 

MINNESOTA (612) 

NEW JERSEY (201) 

NEW YORK, 

Liverpool (315) 

Poughkeepsie (914) 

Woodbury (516) 

NORTH CAROLINA, 

Charlotte (704) 

Raleigh (919) 

OREGON (503) 

OHIO, 

Columbus (614) 

PENNSYLVANIA, 

Allentown (215) 

Willow Grove (215) 

TEXAS, 

Austin (512) 

Dallas (214) 

Houston (713) 

WASHINGTON (206) 

WISCONSIN (414) 



273-3970 
938-0001 
299-0002 

457-5400 
471-8180 
364-8020 

525-1875 
847-8471 
245-0080 

891-6455 

398-8006 
657-3101 

346-7830 
934-9099 
785-9001 
455-3600 
782-7748 



INTERNATIONAL SALES OFFICES 



BELGIUM, 

Bruxelles TEL: (02) 771 99 93 

FAX: 762-3716 

TLX: 61028 

CANADA, Ontario, 

Kanata TEL: (613) 592-0060 

Willowdale TEL: (416) 224-5193 

FAX: (416) 224-0056 

FRANCE, 

Paris TEL: (01) 687.36.66 

FAX: 6862185 

TLX: 20253 

GERMANY, 

Hannover area TEL: (05143) 50 55 

FAX: 5553 

TLX: 925287 

Miinchen TEL: (089) 41 14-0 

FAX: 406490 

TLX: 523883 

Stuttgart TEL: (0711) 62 33 77 

FAX: 625187 

TLX: 721882 



JAPAN, Tokyo . 



HONG KONG, 

Kowloon TEL: 3-695377 

FAX: 1234276 

TLX: 50426 

ITALY, Milano TEL: (02) 3390541 

FAX: 3498000 

TLX: 315286 

TEL: (03) 345-8241 

FAX: 3425196 

TLX: J24064 AMDTKOJ 

LATIN AMERICA, 

Ft Lauderdale TEL: (305) 484-8600 

FAX: (305) 485-9736 

SWEDEN, Stockholm TEL: (08) 733 03 50 

FAX: 7332285 

TLX: 11602 

UNITED KINGDOM, 

Manchester area TEL: (0925) 828008 

FAX: 827693 

TLX: 628524 

London area TEL: (04862) 22121 

FAX: 22179 

TLX; 859103 



NORTH AMERICAN REPRESENTATIVES 



CALIFORNIA 

1^ INC OEM (408) 988-3400 

DISTI (408) 498-6868 
CONNECTICUT 

SCIENTIFIC COMPONENTS (203) 272-2963 

IDAHO 

INTERMOUNTAIN TECH MKGT (208) 322-5022 

INDIANA 

SAI MARKETING CORP (317) 241-9276 

IOWA 

LORENZ SALES (319) 377-4666 

MICHIGAN 

SAI MARKETING CORP (313) 227-1786 

NEBRASKA 

LORENZ SALES (402) 475-4660 



NEW JERSEY 

TAI CORPORATION (609) 933-2600 

NEW MEXICO 

THORSON DESERT STATES (505) 293-8555 

NEW YORK 

NYCOM, INC (315) 437-8343 

OHIO 
Dayton 

DOLFUSS ROOT & CO (513) 433-6776 

Strongsville 

DOLFUSS ROOT & CO (216) 238-0300 

PENNSYLVANIA 

DOLFUSS ROOT & CO (412) 221-4420 

UTAH 

R^ MARKETING (801) 595,0631 



Advanced Micro Devices reserves the right to make changes in its product without notice in order to improve design or performance characteristics. The performance characteristics 
listed in this document are guaranteed by specific tests, con-elated testing, guard banding, design and other practices common to the industry. For specific testing details, contact your 
local AMD sales representative. The company assumes no responsibility for the use of any circuits described herein. 
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